CVE-2013-5123
Fixed in a distro release EPSS 8%
The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.
Products: pypa pip, virtualenv, fedoraproject fedora, redhat openshift, redhat software_collections, debian_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | pip | 1.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | python-pip | 1.4.1-1 |
| Debian 13 | python-pip | 1.4.1-1 |
| Debian 14 | python-pip | 1.4.1-1 |
| SUSE Linux Enterprise Desktop 12 SP4 | python-ply | 3.4-3.3.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP3 | python39-pip | 20.2.4-7.5.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP3 | python39-setuptools | 44.1.1-7.3.1 |
| SUSE Linux Enterprise Module for Public Cloud 12 | python-jmespath | 0.9.2-10.6.1 |
| SUSE Linux Enterprise Module for Public Cloud 12 | python-jsonschema | 2.2.0-3.3.1 |
| SUSE Linux Enterprise Module for Public Cloud 12 | python-paramiko | 1.18.5-2.15.1 |
| SUSE Linux Enterprise Module for Public Cloud 12 | python-pip | 10.0.1-11.6.1 |
| SUSE Linux Enterprise Module for Public Cloud 12 | python-ply | 3.4-3.3.1 |
| SUSE Linux Enterprise Server 12 SP4 | python-ply | 3.4-3.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | python-ply | 3.4-3.3.1 |
| SUSE OpenStack Cloud 7 | python-pip | 10.0.1-11.6.1 |
| SUSE OpenStack Cloud 7 | python-ply | 3.4-3.3.1 |
| openSUSE Tumbleweed | python-pip | 9.0.1-1.1 |
| openSUSE Tumbleweed | python2-pip | 20.0.2-2.6 |