Description
pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-pip | 1.3.1-1 | — |
| Debian 14 | python-virtualenv | 1.9.1-1 | — |
| Debian 13 | python-pip | 1.3.1-1 | — |
| Debian 13 | python-virtualenv | 1.9.1-1 | — |
| Debian 12 | python-pip | 1.3.1-1 | — |
| Debian 12 | python-virtualenv | 1.9.1-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pip | < 1.3 | 1.3 | GHSA-g3p5-fjj9-h8gj |
References
- http://www.pip-installer.org/en/latest/installing.html
- https://github.com/pypa/pip/issues/425
- http://www.pip-installer.org/en/latest/news.html#changelog
- https://github.com/pypa/pip/pull/791/files
- https://bugzilla.redhat.com/show_bug.cgi?id=968059
- http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a/