CVE-2013-1633

Published: Aug 6, 2013Modified: Apr 29, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.

Affected (11)

Products: Python: Setuptools

Python

1 product

Setuptools

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Python Setuptools	version ≤ 0.7b4
Python Setuptools	Version 0.6.40
Python Setuptools	Version 0.6.41
Python Setuptools	Version 0.6.42
Python Setuptools	Version 0.6.43
Python Setuptools	Version 0.6.44
Python Setuptools	Version 0.6.45
Python Setuptools	Version 0.6.46
Python Setuptools	Version 0.6.47
Python Setuptools	Version 0.6.48
Python Setuptools	Version 0.6.49

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (4)

http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a/

Source: cve@mitre.org

https://pypi.python.org/pypi/setuptools/0.9.8#changes

Source: cve@mitre.org

Vendor Advisory

http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a/

Source: af854a3a-2127-422b-91ae-364da2661108

https://pypi.python.org/pypi/setuptools/0.9.8#changes

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.