CVE-2013-1629 Improper Input Validation in pip
Man-in-the-middle attackers can execute arbitrary code by intercepting unverified HTTP package downloads during pip install operations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2013-1629?
CVE-2013-1629 is a medium-severity vulnerability in n/a, published on 6 Aug 2013. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation.
Weakness: CWE-20
Which versions are affected by CVE-2013-1629?
3 open source packages ship an affected version, including pip. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pip PyPI | All versions | 1.3 |
pip PyPI | All versions | 1.3 |
pip PyPI | All versions | 1.3 |
Products include Pypa Pip.
How do I fix CVE-2013-1629?
Upgrade pip to 1.3 or later.
Is CVE-2013-1629 being exploited?
There is no known exploitation of CVE-2013-1629 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2018-20225 Supply chain in n/a
- CVE-2026-13346 pip absolute path traversal during download from malicious package indexes
- CVE-2023-5752 Mercurial configuration injectable in repo revision when installing via pip
- CVE-2026-8643 pip can extract console_scripts and gui_scripts outside installation directory
Sources
Also known as DEBIAN-CVE-2013-1629, GHSA-g3p5-fjj9-h8gj, PYSEC-2013-8.