Quick answers
- Is CVE-2013-1633 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2013-1633 being exploited in the wild.
- How severe is CVE-2013-1633?
- Low severity, with a CVSS score of 3.1, published 6 August 2013.
- Which products and versions are affected?
- setuptools (PyPI) ECOSYSTEM:introduced=0,fixed=0.7; Python Packaging Authority Setuptools before 0.7.
- Is there a fix for CVE-2013-1633?
- Yes. setuptools (PyPI): upgrade to 0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2013-1633 attacked?
- It is attacked over the network or from the adjacent network, in a software library.
- Am I affected by CVE-2013-1633?
- Check whether you run setuptools (PyPI) or Python Packaging Authority Setuptools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- setuptools (PyPI): upgrade to 0.7 or later
pip install "setuptools>=0.7"
Technical details
The vulnerability exists in easy_install, the installation component of setuptools, which retrieves packages from PyPI over HTTP without performing cryptographic integrity checks. An attacker positioned on the network path (man-in-the-middle) can intercept package download responses and serve crafted malicious packages that will be installed and executed. This is a cleartext protocol vulnerability (CWE-319) requiring network adjacency but no authentication. Setuptools 0.7 and later address this by using HTTPS and validating package signatures.
Affected products
- Python Packaging Authority setuptools before 0.7
Identifiers
- CVE-2013-1633
- GHSA-27x4-j476-jp5f
- PYSEC-2013-22
Timeline
- 2013-08-06: disclosed
- 2013: patched: Fixed in version 0.7