CVE-2013-1633

easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which…

published August 6, 2013

CVSS
—
EPSS
2%
Percentile
80.2
In the wild
Unconfirmed
What it is

easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01965 · 80.2th percentile
Published
2013-08-06T01:00Z
EPSS history
Timeline
  • 06 AUG 01:00Z
    easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which…
    cvelistv5