Lucene search
GitHub Advisory DatabaseGHSA-F594-F3V3-G649HistoryMay 17, 2022 - 5:03 a.m.
pyshop vulnerable to man-in-the-middle attacks due to using HTTP to retrieve packages from the PyPI repository
2022-05-1705:03:06
CWE-20
GitHub Advisory Database
github.com
5
pyshop
man-in-the-middle
http
pypi
integrity checks
arbitrary code
download operation
software
CVSS2
6.8
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
AI Score
7.6
Confidence
High
EPSS
0.007
Percentile
80.1%
pyshop before 0.7.1 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a download operation.
Affected configurations
Node
pyshopRange<0.7.1
Related
prion
prion
Design/Logic Flaw
2013-08-06 02:52:00
nvd
nvd
CVE-2013-1630
2013-08-06 02:52:10
cvelist
cvelist
CVE-2013-1630
2013-08-06 01:00:00
cve
cve
CVE-2013-1630
2013-08-06 02:52:10
osv
osv
PYSEC-2013-10
2013-08-06 02:52:00
CVSS2
6.8
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
AI Score
7.6
Confidence
High
EPSS
0.007
Percentile
80.1%
Related for GHSA-F594-F3V3-G649