Red Hat Bugzilla – Bug 1066692
CVE-2013-5123 python-pip: insecure software download with mirroring support
Last modified: 2018-02-15 09:12:03 EST
The mirroring support (-M, --use-mirrors) was implemented without any sort of authenticity checks and is downloaded over plaintext HTTP. Further more by default it will dynamically discover the list of available mirrors by querying a DNS entry and extrapolating from that data. It does not attempt to use any sort of method of securing this querying of the DNS like DNSSEC. Software packages are downloaded over these insecure links, unpacked, and then typically the setup.py python file inside of them is executed. It's a pretty long thread originating here: http://www.openwall.com/lists/oss-security/2013/08/21/18
Created python-pip tracking bugs for this issue: Affects: fedora-all [bug 1160134]
Created python-virtualenv tracking bugs for this issue: Affects: fedora-all [bug 1160135]
Created python-pip tracking bugs for this issue: Affects: epel-all [bug 1160136]
Created python-virtualenv tracking bugs for this issue: Affects: epel-all [bug 1160137]
Upstream changelog lists this issue as fixed in upstream version 1.5: BACKWARD INCOMPATIBLE pip no longer supports the --use-mirrors, -M, and --mirrors flags. The mirroring support has been removed. In order to use a mirror specify it as the primary index with -i or --index-url, or as an additional index with --extra-index-url. (PR #1098, CVE-2013-5123) https://pip.pypa.io/en/latest/news.html https://github.com/pypa/pip/pull/1098 Version 1.5 is available in Fedora 21+ and EPEL-7. Fedora 20 python-pip package uses version 1.4.1. python-virtualenv also includes copy of pip. Currently used versions are virtualenv 1.10.1 (EPEL-6 or RHEL-7) which includes pip 1.4.1, and virtualenv 1.11.6 (Fedora 20+) which includes pip 1.5.6.
python-virtualenv-12.0.7-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
python-virtualenv-12.0.7-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
python-pip-7.1.0-1.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.
python-pip-7.1.0-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.