GHSA-f594-f3v3-g649

pyshop vulnerable to man-in-the-middle attacks due to using HTTP to retrieve packages from the PyPI repository

Source: GitHub Advisory Database (reviewed) High CVE-2013-1630

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	pyshop	< 0.7.1	0.7.1

Details

As written in the advisory (Markdown source, shown as plain text).

pyshop before 0.7.1 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a download operation.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2013-1630 advisory
https://github.com/mardiros/pyshop/commit/ffadb0bcdef1e385884571670210cfd6ba351784 web
https://github.com/mardiros/pyshop package
https://github.com/mardiros/pyshop/blob/master/CHANGES.txt web
https://github.com/pypa/advisory-database/tree/main/vulns/pyshop/PYSEC-2013-10.yaml web
http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a web