TI-2013-01432 Aliases CVE-2013-1629 GHSA-g3p5-fjj9-h8gj

pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not…

LOW 39CWE-20Published 2013-08-06 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Medium
Impact type: —
Confidentiality · integrity · availability: Partial · Partial · Partial
Fix status: Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub.

Summary

pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation.

Why it matters now

EPSS 0.06194 93rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed pip (PyPI): 1.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	pip (PyPI)	before 1.3	1.3	Patch available	GHSA-g3p5-fjj9-h8gj

— Vendor— Affected all versions Fixed in — No fix listed CNA
pip (PyPI) Vendor— Affected before 1.3 Fixed in 1.3 Patch available GHSA-g3p5-fjj9-h8gj

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:pypa:pip::::::::	before 1.3	Vulnerable	pypa

cpe:2.3:a:pypa:pip:*:*:*:*:*:*:*:* Versions before 1.3 Vulnerable ·pypa

Remediation

Fix · GHSA-g3p5-fjj9-h8gj pip (PyPI) Fixed in 1.3 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2013-1629
2026-10-03 Alias added: GHSA-g3p5-fjj9-h8gj

References

Exploit 1

http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a/

Patch 1

https://github.com/pypa/pip/pull/791/files

Advisory 6

Other 3

TI-2018-14332 An issue was discovered in pip (all versions) because it installs the version with the… CVSS 3.1HIGH 7.8
TI-2019-15130 The pip package before 19.2 for Python allows Directory Traversal when a URL is given in… CVSS 3.1HIGH 7.5
TI-2013-04447 The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS… CVSS 3.1MEDIUM 5.9
TI-2021-02521 Improper input validation in python-pip CVSS 3.1MEDIUM 5.7
TI-2026-11308 pip absolute path traversal during download from malicious package indexes CVSS 4.0MEDIUM 5.6
TI-2023-05291 Mercurial configuration injectable in repo revision when installing via pip CVSS 3.1MEDIUM 5.5

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences