CVE-2013-1633 describes a vulnerability in setuptools before version 0.7, where the easy_install utility retrieves packages from PyPI over unencrypted HTTP without integrity checks. This allows a man-in-the-middle attacker to inject malicious code into downloaded packages, leading to arbitrary code execution. The vulnerability has a CVSS score of 6.8, indicating a medium severity with network-based attacks and moderate complexity, potentially impacting confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 0.7b4CPE matchmatch criteria | cpe:2.3:a:python:setuptools:*:*:*:*:*:*:*:* | ||
0.6.40CPE matchmatch criteria | cpe:2.3:a:python:setuptools:0.6.40:*:*:*:*:*:*:* | ||
0.6.41CPE matchmatch criteria | cpe:2.3:a:python:setuptools:0.6.41:*:*:*:*:*:*:* | ||
0.6.42CPE matchmatch criteria | cpe:2.3:a:python:setuptools:0.6.42:*:*:*:*:*:*:* | ||
0.6.43CPE matchmatch criteria | cpe:2.3:a:python:setuptools:0.6.43:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:P/I:P/A:P
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Setuptools vulnerable to Man-in-the-middle attacks
May 17, 2022easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.
Aug 2, 2013python-setuptools: easy_install insecure installation mechanism
Jun 2, 2013