CVE-2013-1630
pyshop vulnerable to man-in-the-middle attacks due to using HTTP to retrieve packages from the PyPI repository
pyshop before 0.7.1 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a download operation.
Exploit likelihood
What each source reports
NVD Score used
pyshop before 0.7.1 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a download operation.
- Record
CVE-2013-1630- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
pyshop before 0.7.1 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a download operation.
- Record
CVE-2013-1630- Updated
- 2026-11-02
EUVDEUVD-2013-0030 No score
pyshop before 0.7.1 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a download operation.
- Record
EUVD-2013-0030- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f594-f3v3-g649
pyshop vulnerable to man-in-the-middle attacks due to using HTTP to retrieve packages from the PyPI repository
pyshop before 0.7.1 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a download operation.
- Record
GHSA-f594-f3v3-g649- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-f594-f3v3-g649
pyshop vulnerable to man-in-the-middle attacks due to using HTTP to retrieve packages from the PyPI repository
pyshop before 0.7.1 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a download operation.
- Record
GHSA-f594-f3v3-g649- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVPYSEC-2013-10 No score
pyshop before 0.7.1 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a download operation.
- Record
PYSEC-2013-10- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-1630 is a medium vulnerability (CVSS 6.8) in Guillaume Gauvrit Pyshop, published August 6, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.09%, the 81st percentile. Fixed in pyshop 0.7.1.
References
github.com/mardiros/pyshop/commit/ffadb0bcdef1e385884571670210cfd6ba351784
reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a
nvd.nist.gov/vuln/detail/CVE-2013-1630