{"id":"CVE-2013-1633","aliases":["AZL-41159","EUVD-2013-0040","GHSA-27x4-j476-jp5f","MGASA-2013-0274","PYSEC-2013-22"],"status":"published","title":"Setuptools vulnerable to Man-in-the-middle attacks","description":"easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0196,"percentile":0.8045,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-319"],"published":"2013-08-06T01:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"PyPI","package":"setuptools","fixed_in":["0.7"],"sources":["ghsa","osv"]},{"ecosystem":"Mageia:2","package":"python-setuptools","fixed_in":["0.9.8-1.1.mga2"],"sources":["osv"]},{"ecosystem":"Mageia:2","package":"python-virtualenv","fixed_in":["1.10.1-0.1.mga2"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"python-setuptools","fixed_in":["0.9.8-2.1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"python-virtualenv","fixed_in":["1.10.1-1.1.mga3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"24.2-11"}]}]},{"source":"osv","ecosystem":"PyPI","package":"setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7"}]}],"versions":["0.6b1","0.6b2","0.6b3","0.6b4","0.6c1","0.6c10","0.6c11","0.6c2","0.6c3","0.6c4","0.6c5","0.6c6","0.6c7","0.6c8","0.6c9"]},{"source":"osv","ecosystem":"Mageia:2","package":"python-setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-1.1.mga2"}]}]},{"source":"osv","ecosystem":"Mageia:2","package":"python-virtualenv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-0.1.mga2"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"python-setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-2.1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"python-virtualenv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-1.1.mga3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7"}]}],"versions":["0.6b1","0.6b2","0.6b3","0.6b4","0.6c1","0.6c10","0.6c11","0.6c2","0.6c3","0.6c4","0.6c5","0.6c6","0.6c7","0.6c8","0.6c9"]}],"products":[{"vendor":"python","product":"setuptools"}],"references":[{"url":"https://pypi.python.org/pypi/setuptools/0.9.8#changes","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a/","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1633","tags":["web","advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2013-22.yaml","tags":["web"]},{"url":"http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a","tags":["web"]},{"url":"https://github.com/advisories/GHSA-27x4-j476-jp5f","tags":["advisory"]},{"url":"https://github.com/pypa/setuptools","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2013-0274.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11169","tags":["report"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2013-September/115118.html","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-1633","description":"easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.","status":"published","published":"2013-08-06T01:00:00Z","modified":"2024-09-16T23:00:21.247Z","updated_at":"2026-11-02T14:34:58.882751Z"}],"euvd":[{"id":"EUVD-2013-0040","description":"easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.","status":"published","published":"2013-08-06T01:00:00Z","modified":"2024-09-16T23:00:21Z","updated_at":"2026-11-03T00:54:58.273879Z"}],"ghsa":[{"id":"GHSA-27x4-j476-jp5f","title":"Setuptools vulnerable to Man-in-the-middle attacks","description":"easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.","status":"published","published":"2022-05-17T05:01:02Z","modified":"2024-10-22T16:40:50Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T14:38:12.325695Z"}],"nvd":[{"id":"CVE-2013-1633","description":"easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.","status":"published","published":"2013-08-06T02:52:10.333Z","modified":"2026-06-16T23:51:48.58Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:31.592595Z"}],"osv":[{"id":"GHSA-27x4-j476-jp5f","title":"Setuptools vulnerable to Man-in-the-middle attacks","description":"easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.","status":"published","published":"2022-05-17T05:01:02Z","modified":"2024-10-22T17:02:06.583304Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"AZL-41159","title":"CVE-2013-1633 affecting package python-pip 24.2-11","description":"easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.","status":"published","published":"2013-08-06T02:52:10Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:19.893001Z"},{"id":"MGASA-2013-0274","title":"Updated python-setuptools and python-virtualenv packages fix security vulnerability","description":"easy_install in setuptools before 0.7 uses HTTP to retrieve packages from\nthe PyPI repository, and does not perform integrity checks on package\ncontents, which allows man-in-the-middle attackers to execute arbitrary\ncode via a crafted response to the default use of the product\n(CVE-2013-1633).\n","status":"published","published":"2013-09-13T20:13:12Z","modified":"2026-04-16T06:25:54.203075216Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"PYSEC-2013-22","description":"easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.","status":"published","published":"2013-08-06T02:52:00Z","modified":"2026-06-10T17:02:39.576960663Z","updated_at":"2026-11-02T15:52:51.645172Z"}]}}