p PatchFirst

CVE-2013-1629

CVE-2013-1629

This page contains facts from public vulnerability sources. Check the original advisory before updating.

pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation.

CVSS 8.6 · High · EPSS 6.2% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • python-pip Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.3.1-1

    Update to 1.3.1-1

  • python-pip Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.3.1-1

    Update to 1.3.1-1

  • python-pip Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.3.1-1

    Update to 1.3.1-1

  • python-virtualenv Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.9.1-1

    Update to 1.9.1-1

  • python-virtualenv Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.9.1-1

    Update to 1.9.1-1

  • python-virtualenv Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.9.1-1

    Update to 1.9.1-1

  • pip PyPI

    Versions
    • 0.2
    • 0.2.1
    • 0.3
    • 0.3.1
    • 0.4
    • 0.5
    • 0.5.1
    • 0.6
    • 0.6.1
    • 0.6.2
    • 0.6.3
    • 0.7
    • 0.7.1
    • 0.7.2
    • 0.8
    • 0.8.1
    • 0.8.2
    • 0.8.3
    • 1.0
    • 1.0.1
    • 1.0.2
    • 1.1
    • 1.2
    • 1.2.1
    Affected ranges
    • ECOSYSTEM: < 1.3

    Update to 1.3

Original sources

Check your server →