~ / search / GHSA-c5h8-cq4v-cvfm

GHSA-c5h8-cq4v-cvfm

Improper Authentication in pip

Source: GitHub Advisory Database (reviewed) High CVE-2013-5123

Packages

EcosystemPackageAffectedFixed in
PyPI pip < 1.5 1.5

Details

As written in the advisory (Markdown source, shown as plain text).

The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.

References

External links from the advisory. They lead to third-party sites.