Skip to content

CVE-2013-1633 Setuptools vulnerable to Man-in-the-middle attacks

MediumCVSS 6.8 EPSS 2.0%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.

Affected products

ProductAffected versionsFixed in
pypi setuptools(PyPI) < 0.7 0.7
pypi setuptools(PyPI) = 0.6b1 No fix listed
pypi setuptools(PyPI) = 0.6b2 No fix listed
pypi setuptools(PyPI) = 0.6b3 No fix listed
pypi setuptools(PyPI) = 0.6b4 No fix listed
pypi setuptools(PyPI) = 0.6c1 No fix listed
pypi setuptools(PyPI) = 0.6c10 No fix listed
pypi setuptools(PyPI) = 0.6c11 No fix listed
pypi setuptools(PyPI) = 0.6c2 No fix listed
pypi setuptools(PyPI) = 0.6c3 No fix listed
pypi setuptools(PyPI) = 0.6c4 No fix listed
pypi setuptools(PyPI) = 0.6c5 No fix listed
pypi setuptools(PyPI) = 0.6c6 No fix listed
pypi setuptools(PyPI) = 0.6c7 No fix listed
pypi setuptools(PyPI) = 0.6c8 No fix listed
pypi setuptools(PyPI) = 0.6c9 No fix listed
python setuptools <= 0.7b4 No fix listed
python setuptools = 0.6.40 No fix listed
python setuptools = 0.6.41 No fix listed
python setuptools = 0.6.42 No fix listed
python setuptools = 0.6.43 No fix listed
python setuptools = 0.6.44 No fix listed
python setuptools = 0.6.45 No fix listed
python setuptools = 0.6.46 No fix listed
python setuptools = 0.6.47 No fix listed
Show 2 more
ProductAffected versionsFixed in
python setuptools = 0.6.48 No fix listed
python setuptools = 0.6.49 No fix listed

References