What’s Vulnerable › Vulnerabilities

CVE-2013-1630

• Severity: medium (CVSS 6.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2013-08-06 · updated 2026-06-16
• Weakness: CWE-20

Description

pyshop before 0.7.1 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a download operation.

Affected products

• Guillaume Gauvrit Pyshop: through 0.7; 0.1, 0.2, 0.3, 0.4, 0.5, 0.6

References

• http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a/
• https://github.com/mardiros/pyshop/blob/master/CHANGES.txt
• https://github.com/mardiros/pyshop/commit/ffadb0bcdef1e385884571670210cfd6ba351784
• http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a/
• https://github.com/mardiros/pyshop/blob/master/CHANGES.txt
• https://github.com/mardiros/pyshop/commit/ffadb0bcdef1e385884571670210cfd6ba351784

Get alerted when CVE-2013-1630 or the next vulnerability affects your stack