CVE-2013-1633
Setuptools vulnerable to Man-in-the-middle attacks
easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.
Exploit likelihood
What each source reports
NVD Score used
easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.
- Record
CVE-2013-1633- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.
- Record
CVE-2013-1633- Updated
- 2026-11-02
EUVDEUVD-2013-0040 No score
easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.
- Record
EUVD-2013-0040- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-27x4-j476-jp5f
Setuptools vulnerable to Man-in-the-middle attacks
easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.
- Record
GHSA-27x4-j476-jp5f- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-319
- Updated
- 2026-11-02
OSVGHSA-27x4-j476-jp5f
Setuptools vulnerable to Man-in-the-middle attacks
easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.
- Record
GHSA-27x4-j476-jp5f- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-319
- Updated
- 2026-11-02
OSVAZL-41159 No score
CVE-2013-1633 affecting package python-pip 24.2-11
easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.
- Record
AZL-41159- Updated
- 2026-11-02
OSVMGASA-2013-0274 No score
Updated python-setuptools and python-virtualenv packages fix security vulnerability
easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product (CVE-2013-1633).
- Record
MGASA-2013-0274- Updated
- 2026-11-02
OSVPYSEC-2013-22 No score
easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.
- Record
PYSEC-2013-22- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
setuptoolsPyPI |
before 0.7 | 0.7 |
python-pipAzure Linux:3 |
through 24.2-11 | None known |
setuptoolsPyPI |
before 0.7, plus listed versions 0.6b10.6b20.6b30.6b40.6c1 Show 10 moreShow less0.6c100.6c110.6c20.6c30.6c40.6c50.6c60.6c70.6c80.6c9 |
0.7 |
python-setuptoolsMageia:2 |
before 0.9.8-1.1.mga2 | 0.9.8-1.1.mga2 |
python-virtualenvMageia:2 |
before 1.10.1-0.1.mga2 | 1.10.1-0.1.mga2 |
python-setuptoolsMageia:3 |
before 0.9.8-2.1.mga3 | 0.9.8-2.1.mga3 |
python-virtualenvMageia:3 |
before 1.10.1-1.1.mga3 | 1.10.1-1.1.mga3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-1633 is a medium vulnerability (CVSS 6.8) in Python Setuptools, published August 6, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.98%, the 80th percentile. Fixed in setuptools 0.7.
References
pypi.python.org/pypi/setuptools/0.9.8
reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a
nvd.nist.gov/vuln/detail/CVE-2013-1633
github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2013-22.yaml
advisories.mageia.org/MGASA-2013-0274.html
bugs.mageia.org/show_bug.cgi?id=11169
lists.fedoraproject.org/pipermail/package-announce/2013-September/115118.html