{"id":"CVE-2013-5123","aliases":["DEBIAN-CVE-2013-5123","EUVD-2019-0103","GHSA-c5h8-cq4v-cvfm","MGASA-2015-0180","PYSEC-2019-160","SUSE-FU-2021:2130-1","SUSE-RU-2019:2505-1","UBUNTU-CVE-2013-5123","openSUSE-SU-2024:10098-1","openSUSE-SU-2024:11251-1","openSUSE-SU-2024:11281-1","openSUSE-SU-2024:13916-1"],"status":"published","title":"Improper Authentication in pip","description":"The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.07987,"percentile":0.94794,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-287"],"published":"2015-05-03T00:19:16Z","modified":"2026-09-01T20:02:13Z","exploits":[{"source":"exploitdb","id":"EDB-24086","title":"phlyLabs phlyMail Lite 4.03.04 - 'go' Open Redirect","type":"webapps","platform":"php","date":"2013-01-13","verified":true,"url":"https://www.exploit-db.com/exploits/24086"}],"fixes":[{"ecosystem":"PyPI","package":"pip","fixed_in":["1.5"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-pip","fixed_in":["1.4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-pip","fixed_in":["1.4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-pip","fixed_in":["1.4.1-1"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"python-pip","fixed_in":["6.1.1-1.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"python-virtualenv","fixed_in":["12.1.1-1.mga4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5"}]}],"versions":["0.2","0.2.1","0.3","0.3.1","0.4","0.5","0.5.1","0.6","0.6.1","0.6.2","0.6.3","0.7","0.7.1","0.7.2","0.8","0.8.1","0.8.2","0.8.3","1.0","1.0.1","1.0.2","1.1","1.2","1.2.1","1.3","1.3.1","1.4","1.4.1"]},{"source":"osv","ecosystem":"Mageia:4","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"python-virtualenv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.1.1-1.mga4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5"}]}],"versions":["0.2","0.2.1","0.3","0.3.1","0.4","0.5","0.5.1","0.6","0.6.1","0.6.2","0.6.3","0.7","0.7.1","0.7.2","0.8","0.8.1","0.8.2","0.8.3","1.0","1.0.1","1.0.2","1.1","1.2","1.2.1","1.3","1.3.1","1.4","1.4.1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"python39-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.2.4-7.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"python39-setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"44.1.1-7.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.1-11.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-ply","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"python-ply","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-jmespath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-10.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-jsonschema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.5-2.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.1-11.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-ply","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"python-ply","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"python-ply","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python2-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.2-2.6"}]}],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"pypa","product":"pip"},{"vendor":"redhat","product":"openshift"},{"vendor":"redhat","product":"software_collections"},{"vendor":"virtualenv","product":"virtualenv"}],"references":[{"url":"https://security-tracker.debian.org/tracker/CVE-2013-5123","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-5123","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","advisory","fix","report","web"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-5123","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","advisory","report","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155248.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","article","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155291.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","article","web"]},{"url":"http://www.openwall.com/lists/oss-security/2013/08/21/17","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","article","web"]},{"url":"http://www.openwall.com/lists/oss-security/2013/08/21/18","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","article","web","report"]},{"url":"http://www.securityfocus.com/bid/77520","tags":["x_refsource_MISC","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-5123","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c5h8-cq4v-cvfm","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2019-160.yaml","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2015-0180.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15748","tags":["report"]},{"url":"https://pip.pypa.io/en/latest/news.html","tags":["web"]},{"url":"http://advisories.mageia.org/MGASA-2015-0120.html","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2015-April/155248.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/-2021-2130/suse-fu-20212130-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1176262","tags":["report"]},{"url":"https://bugzilla.suse.com/1177127","tags":["report"]},{"url":"https://bugzilla.suse.com/1187170","tags":["report"]},{"url":"https://bugzilla.suse.com/428177","tags":["report"]},{"url":"https://bugzilla.suse.com/842516","tags":["report"]},{"url":"https://bugzilla.suse.com/913229","tags":["report"]},{"url":"https://bugzilla.suse.com/930189","tags":["report"]},{"url":"https://bugzilla.suse.com/993968","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20916","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/-2019-2505/suse-ru-20192505-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1065275","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-5123","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-5123","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2013-5123","description":"The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.","status":"published","published":"2019-11-05T21:16:59Z","modified":"2024-08-06T17:06:50.907Z","updated_at":"2026-11-02T14:34:55.508771Z"}],"euvd":[{"id":"EUVD-2019-0103","description":"The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.","status":"published","published":"2019-11-05T21:16:59Z","modified":"2024-08-06T17:06:50Z","updated_at":"2026-11-03T01:56:29.587006Z"}],"ghsa":[{"id":"GHSA-c5h8-cq4v-cvfm","title":"Improper Authentication in pip","description":"The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.","status":"published","published":"2022-05-24T22:01:03Z","modified":"2024-10-14T21:49:10Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"},{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:38:10.696798Z"}],"nvd":[{"id":"CVE-2013-5123","description":"The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.","status":"published","published":"2019-11-05T22:15:10.813Z","modified":"2026-06-16T23:58:22.86Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:02:52.545039Z"}],"osv":[{"id":"CVE-2013-5123","description":"The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.","status":"published","published":"2019-11-05T22:15:10Z","modified":"2026-04-16T06:20:37.546021064Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-5123","description":"The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.","status":"published","published":"2019-11-05T22:15:10.813Z","modified":"2026-09-01T20:02:13.358114817Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"GHSA-c5h8-cq4v-cvfm","title":"Improper Authentication in pip","description":"The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.","status":"published","published":"2022-05-24T22:01:03Z","modified":"2024-10-14T22:00:55.355945Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"},{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:44.571161Z"},{"id":"UBUNTU-CVE-2013-5123","description":"The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.","status":"withdrawn","published":"2019-11-05T22:15:00Z","modified":"2025-07-16T08:10:48.18106Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:07.421078Z"},{"id":"MGASA-2015-0180","title":"Updated python-pip packages fix security vulnerabilities","description":"Updated python-pip and python-virtualenv packages fix security vulnerability:\n\nThe mirroring support in python-pip was implemented without any sort of\nauthenticity checks and is downloaded over plaintext HTTP. Further more by\ndefault it will dynamically discover the list of available mirrors by\nquerying a DNS entry and extrapolating from that data. It does not attempt\nto use any sort of method of securing this querying of the DNS like DNSSEC.\nSoftware packages are downloaded over these insecure links, unpacked, and\nthen typically the setup.py python file inside of them is executed\n(CVE-2013-5123).\n\nThis was fixed in python-pip by removing the mirroring support (i.e., the\n--use-mirrors, -M, and --mirrors flags). With the updated version, in order\nto use a mirror, one must specify it as the primary index with -i or\n--index-url, or as an additional index with --extra-index-url.\n\nThe python-virtualenv package bundles a copy of python-pip, so it has also\nbeen updated to fix this issue.\n\nThe python-virtualenv package bundles python-requests as well, so this update\nfixes the session fixation issue CVE-2015-2296 in the bundled python-requests.\n","status":"published","published":"2015-05-03T00:19:16Z","modified":"2026-04-16T06:22:25.337657348Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10098-1","title":"python-pip-8.1.2-1.2 on GA media","description":"These are all security issues fixed in the python-pip-8.1.2-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:26:20.573673Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:11251-1","title":"python36-pip-20.2.4-1.8 on GA media","description":"These are all security issues fixed in the python36-pip-20.2.4-1.8 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:46:45.664605Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:11281-1","title":"python2-pip-20.0.2-2.6 on GA media","description":"These are all security issues fixed in the python2-pip-20.0.2-2.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:53:55.878981Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:13916-1","title":"python310-pip-24.0-1.1 on GA media","description":"These are all security issues fixed in the python310-pip-24.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:47:13.670352Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"PYSEC-2019-160","description":"The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.","status":"published","published":"2019-11-05T22:15:00Z","modified":"2023-11-08T03:57:25.017822Z","updated_at":"2026-11-02T15:52:52.192131Z"},{"id":"SUSE-FU-2021:2130-1","title":"Feature implementation for python39-pip, python39-setuptools","description":"This update for python39-pip, python39-setuptools fixes the following issues:\n\nChanges in python39-setuptools:\n\n- Provide `python39-setuptools` version 44.1.1 with vendored dependencies. (jsc#SLE-17532, jsc#SLE-17957)\n\nChanges in python39-pip:\n\n- Provide `python39-pip` version 20.2.4 with vendored dependencies. (jsc#SLE-17532, jsc#SLE-17957)\n\n  ","status":"published","published":"2021-06-23T07:10:31Z","modified":"2026-02-04T03:55:32.396464Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-RU-2019:2505-1","title":"Recommended update for python-jmespath, python-jsonschema, python-paramiko, python-pexpect, python-pip, python-ply, python-pretend, python-process-tests, python-pycodestyle, python-pyflakes, python-pyxdg, python-tabulate, python-vcversioner","description":"\nThis update for python-jmespath, python-jsonschema, python-paramiko, python-pexpect, python-pip, python-ply, python-pretend, python-process-tests, python-pycodestyle, python-pyflakes, python-pyxdg, python-tabulate, python-vcversioner fixes the following issues:\n\npython-pip was updated to 10.0.1 (fate#324191, bsc#1065275)\n\nEnable python3 build for:\n\n- python-jmespath\n- python-jsonschema\n- python-paramiko\n- python-pexpect\n- python-pip\n- python-ply\n- python-pretend\n- python-process-tests\n- python-pycodestyle\n- python-pyflakes\n- python-pyxdg\n- python-tabulate\n- python-vcversioner\n\n\n","status":"published","published":"2019-10-01T11:10:29Z","modified":"2026-02-04T04:01:19.918319Z","updated_at":"2026-11-02T15:53:41.276824Z"}]}}