CVE-2013-1630 | BDVDB-2026-56890 Detail

Description#

pyshop before 0.7.1 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a download operation.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://github.com/mardiros/pyshop/commit/ffadb0bcdef1e385884571670210cfd6ba351784
https://github.com/mardiros/pyshop/blob/master/CHANGES.txt
http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a/

Exploit#

No public exploit known

History#

Version 12013-08-06Record published in the CVE List.
Version 22024-09-16Most recent update recorded in the CVE List.