CVE-2013-1629

pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows…

published August 6, 2013

CVSS
—
EPSS
6%
Percentile
93.5
In the wild
Unconfirmed
What it is

pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.06194 · 93.5th percentile
Published
2013-08-06T01:00Z
EPSS history
Timeline
  • 06 AUG 01:00Z
    pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows…
    cvelistv5