Python pip CVE-2013-1629 SSL Certificate Validation Security Bypass Vulnerability
BID:61573
Info
Python pip CVE-2013-1629 SSL Certificate Validation Security Bypass Vulnerability
| Bugtraq ID: | 61573 |
| Class: | Design Error |
| CVE: |
CVE-2013-1629 |
| Remote: | No |
| Local: | Yes |
| Published: | May 28 2013 12:00AM |
| Updated: | May 28 2013 12:00AM |
| Credit: | Donald Stufft |
| Vulnerable: |
python pip 1.0 |
| Not Vulnerable: |
python pip 1.3 |
Discussion
Python pip CVE-2013-1629 SSL Certificate Validation Security Bypass Vulnerability
Python pip is prone to a security-bypass vulnerability because the application fails to properly validate SSL certificates.
Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.
Versions prior to Python pip 1.3 are vulnerable.
Python pip is prone to a security-bypass vulnerability because the application fails to properly validate SSL certificates.
Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.
Versions prior to Python pip 1.3 are vulnerable.
Exploit / POC
Python pip CVE-2013-1629 SSL Certificate Validation Security Bypass Vulnerability
An attacker can use readily available network utilities to exploit this issue.
An attacker can use readily available network utilities to exploit this issue.
Solution / Fix
Python pip CVE-2013-1629 SSL Certificate Validation Security Bypass Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Python pip CVE-2013-1629 SSL Certificate Validation Security Bypass Vulnerability
References:
References: