NVD

Id
37805  
Name
CVE-2013-1629  
Description
pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2013-08-05  
Modified Date
2013-09-24  
Seq
2013-1629  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
192489 37805 CVE-2013-1629 http://www.pip-installer.org/en/latest/installing.html  View
192490 37805 CVE-2013-1629 http://www.pip-installer.org/en/latest/news.html#changelog  View
192491 37805 CVE-2013-1629 http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a/  View
192492 37805 CVE-2013-1629 https://bugzilla.redhat.com/show_bug.cgi?id=968059  View
192493 37805 CVE-2013-1629 https://github.com/pypa/pip/issues/425  View
192494 37805 CVE-2013-1629 https://github.com/pypa/pip/pull/791/files  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
22076 JVNDB-2013-003651 pip における任意のコードを実行される脆弱性 pip は、PyPI のリポジトリからパッケージを取得するために HTTP を使用する、およびパッケージの内容の整合性チェックを実行しないため、任意のコードを実行される脆弱性が存在します。 CVE-2013-1629 61571 CVE-2013-1629 37805 6.8 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-003651.html 2013-03-07 2013-08-07 View