GitHub Advisoryadvisory · PyPI

GHSA-27x4-j476-jp5f Setuptools vulnerable to Man-in-the-middle attacks

HIGH Published 2022-05-17 Modified 2024-10-22 Official page ↗
Aliases
CVE-2013-1633
Ecosystem
PyPI
Packages
setuptools
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-319
Reviewed
2023-08-29

Affected packages

• PyPI setuptools: < 0.7 → fixed in 0.7

Description

easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.

Related

Alias · CVE (1)

  • CVE-2013-1633 easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on… vulnerability

Weakness · CWE (1)

  • CWE-319 Cleartext Transmission of Sensitive Information weakness

References