Bug 1066692 (CVE-2013-5123)

Summary:	CVE-2013-5123 python-pip: insecure software download with mirroring support
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bleanhar, ccoleman, dmcphers, drieden, fschwarz, jialiu, lmeyer, metherid, mmaslano, mmcgrath, mrunge, nobody+bgollahe, python-maint, smilner, tdawson, tflink
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	python-pip 1.5	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-20 10:43:51 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1160134, 1160135, 1160136, 1160137
Bug Blocks:	1160302

Description Vincent Danen 2014-02-18 22:34:14 UTC

The mirroring support (-M, --use-mirrors) was implemented without
any sort of authenticity checks and is downloaded over plaintext
HTTP. Further more by default it will dynamically discover the list of
available mirrors by querying a DNS entry and extrapolating from that
data. It does not attempt to use any sort of method of securing this
querying of the DNS like DNSSEC. Software packages are downloaded over
these insecure links, unpacked, and then typically the setup.py python
file inside of them is executed.

It's a pretty long thread originating here:

http://www.openwall.com/lists/oss-security/2013/08/21/18

Comment 1 Kurt Seifried 2014-11-04 06:12:41 UTC

Created python-pip tracking bugs for this issue:

Affects: fedora-all [bug 1160134]

Comment 2 Kurt Seifried 2014-11-04 06:12:44 UTC

Created python-virtualenv tracking bugs for this issue:

Affects: fedora-all [bug 1160135]

Comment 3 Kurt Seifried 2014-11-04 06:13:06 UTC

Created python-pip tracking bugs for this issue:

Affects: epel-all [bug 1160136]

Comment 4 Kurt Seifried 2014-11-04 06:13:09 UTC

Created python-virtualenv tracking bugs for this issue:

Affects: epel-all [bug 1160137]

Comment 5 Tomas Hoger 2015-01-14 12:41:08 UTC

Upstream changelog lists this issue as fixed in upstream version 1.5:

BACKWARD INCOMPATIBLE pip no longer supports the --use-mirrors, -M, and --mirrors flags. The mirroring support has been removed. In order to use a mirror specify it as the primary index with -i or --index-url, or as an additional index with --extra-index-url. (PR #1098, CVE-2013-5123)

https://pip.pypa.io/en/latest/news.html
https://github.com/pypa/pip/pull/1098

Version 1.5 is available in Fedora 21+ and EPEL-7.  Fedora 20 python-pip package uses version 1.4.1.

python-virtualenv also includes copy of pip.  Currently used versions are virtualenv 1.10.1 (EPEL-6 or RHEL-7) which includes pip 1.4.1, and virtualenv 1.11.6 (Fedora 20+) which includes pip 1.5.6.

Comment 6 Fedora Update System 2015-04-21 18:54:50 UTC

python-virtualenv-12.0.7-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2015-04-21 18:59:35 UTC

python-virtualenv-12.0.7-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2015-07-20 19:47:22 UTC

python-pip-7.1.0-1.el7 has been pushed to the Fedora EPEL 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2015-07-20 19:47:41 UTC

python-pip-7.1.0-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.