What’s Vulnerable › Vulnerabilities

CVE-2013-1633

• Severity: medium (CVSS 6.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2013-08-06 · updated 2026-06-16
• Weakness: CWE-20

Description

easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.

Affected products

• pypa setuptools: through 0.7b4; 0.6.40, 0.6.41, 0.6.42, 0.6.43, 0.6.44, 0.6.45 (+4)

References

• http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a/
• https://pypi.python.org/pypi/setuptools/0.9.8#changes
• http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a/
• https://pypi.python.org/pypi/setuptools/0.9.8#changes

Get alerted when CVE-2013-1633 or the next vulnerability affects your stack