« Volver al listado

CVE-2013-1633

Estado: ModificadaMedia (6.8)—

easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Python — Setuptools

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-1633",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-08-06T02:52:10.333",
  "references": [
    {
      "url": "http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a/",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://pypi.python.org/pypi/setuptools/0.9.8#changes",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://pypi.python.org/pypi/setuptools/0.9.8#changes",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product."
    },
    {
      "lang": "es",
      "value": "easy_install en setuptools anterior a v0.7 utiliza HTTP para recuperar paquetes del repositorio PyPI, y no realiza comprobaciones de integridad en el contenido del paquete, que permite a atacantes man-in-the-middle ejecutar código arbitrario a través de una respuesta diseñada para el uso por defecto del producto."
    }
  ],
  "lastModified": "2026-06-16T23:51:48.580",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:python:setuptools:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98A58C30-8685-466E-8B39-9041F8610F0B",
              "versionEndIncluding": "0.7b4"
            },
            {
              "criteria": "cpe:2.3:a:python:setuptools:0.6.40:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D2F5E989-AA4A-45DB-AD38-8B6F3E6623CD"
            },
            {
              "criteria": "cpe:2.3:a:python:setuptools:0.6.41:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3AAAA31F-ADB7-4EB6-A224-B9E2D9AD2580"
            },
            {
              "criteria": "cpe:2.3:a:python:setuptools:0.6.42:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B08D7F14-EB7C-485C-BD6A-1BAE031A6CFB"
            },
            {
              "criteria": "cpe:2.3:a:python:setuptools:0.6.43:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43239CDF-E50A-4B9C-900F-B87BC5887A9F"
            },
            {
              "criteria": "cpe:2.3:a:python:setuptools:0.6.44:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F41C30F2-9179-4900-BF9B-A0608234396A"
            },
            {
              "criteria": "cpe:2.3:a:python:setuptools:0.6.45:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B25FAC3B-A576-4B65-8B3E-4E9027C39CE4"
            },
            {
              "criteria": "cpe:2.3:a:python:setuptools:0.6.46:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "593B1342-E84E-446D-B35E-22E66BC300E8"
            },
            {
              "criteria": "cpe:2.3:a:python:setuptools:0.6.47:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "307E98F8-BD9E-4229-AB24-D844391B8E70"
            },
            {
              "criteria": "cpe:2.3:a:python:setuptools:0.6.48:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "932A450D-0A73-4593-954E-5584066B17D7"
            },
            {
              "criteria": "cpe:2.3:a:python:setuptools:0.6.49:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3666BF98-9FC4-42CC-A1C3-437CDF3E4DE5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}