# CVE-2013-1633: Setuptools man-in-the-middle attack in package installation

Source: https://junglewise.ai/threats/cve-2013-1633-setuptools-man-in-the-middle-attack-in-package-installation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2013-08-06. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2013-1633 · Severity: low · CVSS 3.1 · Published 2013-08-06

Setuptools is a Python package management library used to install software dependencies. Versions before 0.7 download packages over unencrypted HTTP without verifying package integrity, allowing attackers on the network to intercept downloads and inject malicious code that executes with the privileges of the installing user.

Technologies: [setuptools (PyPI)](https://junglewise.ai/threats/technologies/pypi-setuptools), [Python Packaging Authority Setuptools](https://junglewise.ai/threats/technologies/setuptools). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Python Packaging Authority](https://junglewise.ai/threats/vendors/python-packaging-authority).

## Quick answers

**Is CVE-2013-1633 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2013-1633 being exploited in the wild.

**How severe is CVE-2013-1633?** Low severity, with a CVSS score of 3.1, published 6 August 2013.

**Which products and versions are affected?** setuptools (PyPI) ECOSYSTEM:introduced=0,fixed=0.7; Python Packaging Authority Setuptools before 0.7.

**Is there a fix for CVE-2013-1633?** Yes. setuptools (PyPI): upgrade to 0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2013-1633 attacked?** It is attacked over the network or from the adjacent network, in a software library.

**Am I affected by CVE-2013-1633?** Check whether you run setuptools (PyPI) or Python Packaging Authority Setuptools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- setuptools (PyPI): upgrade to 0.7 or later

  ```sh
  pip install "setuptools>=0.7"
  ```


## Technical details

The vulnerability exists in easy_install, the installation component of setuptools, which retrieves packages from PyPI over HTTP without performing cryptographic integrity checks. An attacker positioned on the network path (man-in-the-middle) can intercept package download responses and serve crafted malicious packages that will be installed and executed. This is a cleartext protocol vulnerability (CWE-319) requiring network adjacency but no authentication. Setuptools 0.7 and later address this by using HTTPS and validating package signatures.

## Affected products

- Python Packaging Authority setuptools before 0.7

## Identifiers

- CVE-2013-1633
- GHSA-27x4-j476-jp5f
- PYSEC-2013-22

## Timeline

- 2013-08-06: disclosed
- 2013: patched: Fixed in version 0.7

## References

- [https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2013-22.yaml](https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2013-22.yaml)

## Related threats

- [setuptools path escape via namespace_packages.txt on Windows](https://junglewise.ai/threats/setuptools-windows-path-escape-via-namespace-packages-txt-during-legacy-93ae767b)
- [pypa setuptools Unicode normalization bypass in MANIFEST.in exclusions](https://junglewise.ai/threats/cve-2026-59890-pypa-setuptools-unicode-normalization-bypass-in-manifest-in)
- [PYSEC-2026-1918 - setuptools vulnerable to Command Injection via package URL](https://junglewise.ai/threats/cve-2024-6345-setuptools-vulnerable-to-command-injection-via-package-url)
- [PyPA wheel path traversal in unpack function](https://junglewise.ai/threats/cve-2026-24049-pypa-wheel-path-traversal-in-unpack-function)
- [setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write](https://junglewise.ai/threats/cve-2025-47273-setuptools-has-a-path-traversal-vulnerability-in-packageindex)