Executive brief
Setuptools is a Python package management library used to install software dependencies. Versions before 0.7 download packages over unencrypted HTTP without verifying package integrity, allowing attackers on the network to intercept downloads and inject malicious code that executes with the privileges of the installing user.
Technical details
The vulnerability exists in easy_install, the installation component of setuptools, which retrieves packages from PyPI over HTTP without performing cryptographic integrity checks. An attacker positioned on the network path (man-in-the-middle) can intercept package download responses and serve crafted malicious packages that will be installed and executed. This is a cleartext protocol vulnerability (CWE-319) requiring network adjacency but no authentication. Setuptools 0.7 and later address this by using HTTPS and validating package signatures.
Affected products
- Python Packaging Authority setuptools before 0.7
Timeline
- 2013-08-06: disclosed
- 2013: patched: Fixed in version 0.7