CVE-2013-5123
Improper Authentication in pip
The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.
- Record
CVE-2013-5123- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.
- Record
CVE-2013-5123- Updated
- 2026-11-02
EUVDEUVD-2019-0103 No score
The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.
- Record
EUVD-2019-0103- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c5h8-cq4v-cvfm
Improper Authentication in pip
The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.
- Record
GHSA-c5h8-cq4v-cvfm- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
OSV
The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.
- Record
CVE-2013-5123- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-5123
The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.
- Record
DEBIAN-CVE-2013-5123- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 10 moreShow less
OSVGHSA-c5h8-cq4v-cvfm
Improper Authentication in pip
The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.
- Record
GHSA-c5h8-cq4v-cvfm- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-5123
The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.
- Record
UBUNTU-CVE-2013-5123- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVMGASA-2015-0180 No score
Updated python-pip packages fix security vulnerabilities
Updated python-pip and python-virtualenv packages fix security vulnerability:
The mirroring support in python-pip was implemented without any sort of authenticity checks and is downloaded over plaintext HTTP. Further more by default it will dynamically discover the list of available mirrors by querying a DNS entry and extrapolating from that data. It does not attempt to use any sort of method of securing this querying of the DNS like DNSSEC. Software packages are downloaded over these insecure links, unpacked, and then typically the setup.py python file inside of them is executed (CVE-2013-5123).
This was fixed in python-pip by removing the mirroring support (i.e., the --use-mirrors, -M, and --mirrors flags). With the updated version, in order to use a mirror, one must specify it as the primary index with -i or --index-url, or as an additional index with --extra-index-url.
The python-virtualenv package bundles a copy of python-pip, so it has also been updated to fix this issue.
The python-virtualenv package bundles python-requests as well, so this update fixes the session fixation issue CVE-2015-2296 in the bundled python-requests.
- Record
MGASA-2015-0180- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10098-1 No score
python-pip-8.1.2-1.2 on GA media
These are all security issues fixed in the python-pip-8.1.2-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10098-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11251-1 No score
python36-pip-20.2.4-1.8 on GA media
These are all security issues fixed in the python36-pip-20.2.4-1.8 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11251-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11281-1 No score
python2-pip-20.0.2-2.6 on GA media
These are all security issues fixed in the python2-pip-20.0.2-2.6 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11281-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13916-1 No score
python310-pip-24.0-1.1 on GA media
These are all security issues fixed in the python310-pip-24.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13916-1- Updated
- 2026-11-02
OSVPYSEC-2019-160 No score
The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.
- Record
PYSEC-2019-160- Updated
- 2026-11-02
OSVSUSE-FU-2021:2130-1 No score
Feature implementation for python39-pip, python39-setuptools
This update for python39-pip, python39-setuptools fixes the following issues:
Changes in python39-setuptools:
- Provide
python39-setuptoolsversion 44.1.1 with vendored dependencies. (jsc#SLE-17532, jsc#SLE-17957)
Changes in python39-pip:
- Provide
python39-pipversion 20.2.4 with vendored dependencies. (jsc#SLE-17532, jsc#SLE-17957)
- Record
SUSE-FU-2021:2130-1- Updated
- 2026-11-02
OSVSUSE-RU-2019:2505-1 No score
Recommended update for python-jmespath, python-jsonschema, python-paramiko, python-pexpect, python-pip, python-ply, python-pretend, python-process-tests, python-pycodestyle, python-pyflakes, python-pyxdg, python-tabulate, python-vcversioner
This update for python-jmespath, python-jsonschema, python-paramiko, python-pexpect, python-pip, python-ply, python-pretend, python-process-tests, python-pycodestyle, python-pyflakes, python-pyxdg, python-tabulate, python-vcversioner fixes the following issues:
python-pip was updated to 10.0.1 (fate#324191, bsc#1065275)
Enable python3 build for:
- python-jmespath
- python-jsonschema
- python-paramiko
- python-pexpect
- python-pip
- python-ply
- python-pretend
- python-process-tests
- python-pycodestyle
- python-pyflakes
- python-pyxdg
- python-tabulate
- python-vcversioner
- Record
SUSE-RU-2019:2505-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pipPyPI |
before 1.5 | 1.5 |
python-pipDebian:12 |
before 1.4.1-1 | 1.4.1-1 |
python-pipDebian:13 |
before 1.4.1-1 | 1.4.1-1 |
python-pipDebian:14 |
before 1.4.1-1 | 1.4.1-1 |
pipPyPI |
before 1.5, plus listed versions 0.20.2.10.30.3.10.4 Show 23 moreShow less0.50.5.10.60.6.10.6.20.6.30.70.7.10.7.20.80.8.10.8.20.8.31.01.0.11.0.21.11.21.2.11.31.3.11.41.4.1 |
1.5 |
python-pipMageia:4 |
before 6.1.1-1.mga4 | 6.1.1-1.mga4 |
python-virtualenvMageia:4 |
before 12.1.1-1.mga4 | 12.1.1-1.mga4 |
python39-pipSUSE:Linux Enterprise Module for Basesystem 15 SP3 From an advisory covering 4 CVEs |
before 20.2.4-7.5.1 | 20.2.4-7.5.1 |
python39-setuptoolsSUSE:Linux Enterprise Module for Basesystem 15 SP3 From an advisory covering 4 CVEs |
before 44.1.1-7.3.1 | 44.1.1-7.3.1 |
python-pipSUSE:OpenStack Cloud 7 From an advisory covering 3 CVEs |
before 10.0.1-11.6.1 | 10.0.1-11.6.1 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-plySUSE:OpenStack Cloud 7 From an advisory covering 3 CVEs |
before 3.4-3.3.1 | 3.4-3.3.1 |
python-plySUSE:Linux Enterprise Desktop 12 SP4 From an advisory covering 3 CVEs |
before 3.4-3.3.1 | 3.4-3.3.1 |
python-jmespathSUSE:Linux Enterprise Module for Public Cloud 12 From an advisory covering 3 CVEs |
before 0.9.2-10.6.1 | 0.9.2-10.6.1 |
python-jsonschemaSUSE:Linux Enterprise Module for Public Cloud 12 From an advisory covering 3 CVEs |
before 2.2.0-3.3.1 | 2.2.0-3.3.1 |
python-paramikoSUSE:Linux Enterprise Module for Public Cloud 12 From an advisory covering 3 CVEs |
before 1.18.5-2.15.1 | 1.18.5-2.15.1 |
python-pipSUSE:Linux Enterprise Module for Public Cloud 12 From an advisory covering 3 CVEs |
before 10.0.1-11.6.1 | 10.0.1-11.6.1 |
python-plySUSE:Linux Enterprise Module for Public Cloud 12 From an advisory covering 3 CVEs |
before 3.4-3.3.1 | 3.4-3.3.1 |
python-plySUSE:Linux Enterprise Server 12 SP4 From an advisory covering 3 CVEs |
before 3.4-3.3.1 | 3.4-3.3.1 |
python-plySUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 3 CVEs |
before 3.4-3.3.1 | 3.4-3.3.1 |
python-pipopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 9.0.1-1.1 | 9.0.1-1.1 |
python2-pipopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 20.0.2-2.6 | 20.0.2-2.6 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | phlyLabs phlyMail Lite 4.03.04 - 'go' Open Redirect | 2013-01-13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-5123 is a medium vulnerability (CVSS 5.9) in Pypa Pip, published May 3, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 7.99%, the 94th percentile. Fixed in pip 1.5.
References
security-tracker.debian.org/tracker/CVE-2013-5123
bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-5123
bugzilla.suse.com/show_bug.cgi?id=CVE-2013-5123
lists.fedoraproject.org/pipermail/package-announce/2015-April/155248.html
openwall.com/lists/oss-security/2013/08/21/17
Show 26 moreShow less
securityfocus.com/bid/77520
nvd.nist.gov/vuln/detail/CVE-2013-5123
github.com/advisories/GHSA-c5h8-cq4v-cvfm
advisories.mageia.org/MGASA-2015-0180.html
bugs.mageia.org/show_bug.cgi?id=15748
pip.pypa.io/en/latest/news.html
suse.com/support/update/announcement/-2021-2130/suse-fu-20212130-1
ubuntu.com/security/CVE-2013-5123
cve.org/CVERecord?id=CVE-2013-5123