CVE-2013-1629

pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation.

• CWE-20

• http://www.pip-installer.org/en/latest/installing.htmlVendor Advisory
• http://www.pip-installer.org/en/latest/news.html#changelogRelease Notes, Vendor Advisory
• http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a/Exploit, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=968059Issue Tracking, Third Party Advisory
• https://github.com/pypa/pip/issues/425Third Party Advisory
• https://github.com/pypa/pip/pull/791/filesPatch, Third Party Advisory
• http://www.pip-installer.org/en/latest/installing.htmlVendor Advisory
• http://www.pip-installer.org/en/latest/news.html#changelogRelease Notes, Vendor Advisory
• http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a/Exploit, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=968059Issue Tracking, Third Party Advisory
• https://github.com/pypa/pip/issues/425Third Party Advisory
• https://github.com/pypa/pip/pull/791/filesPatch, Third Party Advisory

Published

Aug 6, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-1621Array index error in the SSL module in PolarSSL before 1.2.5…
• CVE-2013-1622Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2013-1623The TLS and DTLS implementations in wolfSSL CyaSSL before 2.…
• CVE-2013-1624The TLS implementation in the Bouncy Castle Java library bef…
• CVE-2013-1627Absolute path traversal vulnerability in NTWebServer.exe in …
• CVE-2013-1628Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2013-1630pyshop before 0.7.1 uses HTTP to retrieve packages from the …
• CVE-2013-1631Verax NMS prior to 2.1.0 leaks connection details when any u…5.3
• CVE-2013-1633easy_install in setuptools before 0.7 uses HTTP to retrieve …
• CVE-2013-1634A denial of service vulnerability exists in some motherboard…7.5
• CVE-2013-1635ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13…
• CVE-2013-1636Cross-site scripting (XSS) vulnerability in open-flash-chart…