CVE-2013-1633: Input Validation
Published Aug 6, 2013
·Updated
easyinstall in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.
Affected Software
12 affected componentsFixes available
pip/setuptools<0.7
0.7
Python setuptools<=0.7b4
Python setuptools=0.6.40
Python setuptools=0.6.41
Python setuptools=0.6.42
Python setuptools=0.6.43
Python setuptools=0.6.44
Python setuptools=0.6.45
Python setuptools=0.6.46
Python setuptools=0.6.47
Python setuptools=0.6.48
Python setuptools=0.6.49
Event History
Aug 6, 2013
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
May 17, 2022
Advisory Published
05:01 AM
Frequently Asked Questions
1
What is the severity of CVE-2013-1633?
CVE-2013-1633 has a medium severity rating due to the potential for arbitrary code execution by man-in-the-middle attacks.
2
How do I fix CVE-2013-1633?
To fix CVE-2013-1633, upgrade setuptools to version 0.7 or later.
3
Which versions of setuptools are affected by CVE-2013-1633?
CVE-2013-1633 affects all versions of setuptools prior to 0.7.
4
What type of attack is enabled by CVE-2013-1633?
CVE-2013-1633 enables man-in-the-middle attacks that can lead to arbitrary code execution.
5
Is it safe to use easy_install in setuptools before version 0.7?
Using easy_install in setuptools before version 0.7 is unsafe due to the lack of integrity checks on downloaded packages.