CVE-2013-1629

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2013-08-06 · updated 2026-06-16
Weakness: CWE-20

Description

pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation.

Affected products

Python Packaging Authority pip: before 1.3 — fixed in 1.3

How to fix

Upgrade to a fixed version: Python Packaging Authority pip 1.3. Check the vendor advisory for mitigations.

References

http://www.pip-installer.org/en/latest/installing.html
http://www.pip-installer.org/en/latest/news.html#changelog
http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a/
https://bugzilla.redhat.com/show_bug.cgi?id=968059
https://github.com/pypa/pip/issues/425
https://github.com/pypa/pip/pull/791/files
http://www.pip-installer.org/en/latest/installing.html
http://www.pip-installer.org/en/latest/news.html#changelog
http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a/
https://bugzilla.redhat.com/show_bug.cgi?id=968059
https://github.com/pypa/pip/issues/425
https://github.com/pypa/pip/pull/791/files

Get alerted when CVE-2013-1629 or the next vulnerability affects your stack