CVE-2013-1629
Fixed in a distro release EPSS 6%
pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation.
Products: pypa pip
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | pip | 1.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | python-pip | 1.3.1-1 |
| Debian 12 | python-virtualenv | 1.9.1-1 |
| Debian 13 | python-pip | 1.3.1-1 |
| Debian 13 | python-virtualenv | 1.9.1-1 |
| Debian 14 | python-pip | 1.3.1-1 |
| Debian 14 | python-virtualenv | 1.9.1-1 |