CVE-2013-1629

2013-08-0601:00:00

mitre

www.cve.org

cve-2013-1629

pypi repository

integrity checks

man-in-the-middle

arbitrary code execution

pip install

AI Score

7.1

Confidence

Low

EPSS

0.004

Percentile

73.0%

JSON

pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a “pip install” operation.