CVE-2013-5123 Improper Authentication in pip
Attackers can perform man-in-the-middle attacks on pip mirror downloads, potentially leading to code execution or data theft.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-5123?
CVE-2013-5123 is a medium-severity vulnerability in Debian Debian Linux, published on 5 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.
Weakness: CWE-287
Which versions are affected by CVE-2013-5123?
3 open source packages ship an affected version, including pip. It affects 6 products.
| Package | Affected | Fixed in |
|---|---|---|
pip PyPI | All versions | 1.5 |
pip PyPI | All versions | 1.5 |
pip PyPI | All versions | 1.5 |
Products include Debian Debian Linux, Fedoraproject Fedora, Pypa Pip, Redhat Openshift, Redhat Software Collections, Virtualenv Virtualenv.
How do I fix CVE-2013-5123?
Upgrade pip to 1.5 or later.
Is CVE-2013-5123 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2013-5123 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as CVE-2013-4266, DEBIAN-CVE-2013-5123, GHSA-c5h8-cq4v-cvfm, MGASA-2015-0180, PYSEC-2019-160.