Unscored severity · published Aug 6, 2013
CVE-2013-1633
easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows…
–
CVSS
2%
EPSS
No
On KEV
Description
easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Setuptools · Python
through 0.7b4; 0.6.40; 0.6.41; 0.6.42; 0.6.43; 0.6.44; +5 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-1633
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-1633
www.reddit.com
http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a/
Vendor Advisory
https://pypi.python.org/pypi/setuptools/0.9.8#changes
More from Setuptools
8.8
CVE-2025-47273
setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages
6.1
CVE-2026-59890
setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+
5.9
CVE-2022-40897
Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page