Описание
pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation.
| Релиз | Статус | Примечание |
|---|---|---|
| artful | not-affected | |
| bionic | not-affected | |
| devel | not-affected | |
| esm-apps-legacy/xenial | not-affected | 8.1.1-2ubuntu0.4 |
| esm-apps/bionic | not-affected | |
| esm-apps/xenial | not-affected | 8.1.1-2ubuntu0.4 |
| esm-infra-legacy/trusty | not-affected | 1.5.4-1ubuntu4 |
| lucid | ignored | end of life |
| precise | ignored | end of life |
| precise/esm | DNE | precise was needed |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| artful | not-affected | 1.9.1-1 |
| bionic | not-affected | 1.9.1-1 |
| devel | not-affected | 1.9.1-1 |
| esm-apps-legacy/xenial | not-affected | 1.9.1-1 |
| esm-apps/bionic | not-affected | 1.9.1-1 |
| esm-apps/xenial | not-affected | 1.9.1-1 |
| esm-infra-legacy/trusty | not-affected | 1.9.1-1 |
| lucid | ignored | end of life |
| precise | ignored | end of life |
| precise/esm | DNE | precise was needed |
Показывать по
Ссылки на источники
6.8 Medium
CVSS2
Связанные уязвимости
pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation.
pip before 1.3 uses HTTP to retrieve packages from the PyPI repository ...
6.8 Medium
CVSS2