Bug 1066692 (CVE-2013-5123) - CVE-2013-5123 python-pip: insecure software download with mirroring support
Summary: CVE-2013-5123 python-pip: insecure software download with mirroring support
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2013-5123
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1160134 1160135 1160136 1160137
Blocks: 1160302
TreeView+ depends on / blocked
 
Reported: 2014-02-18 22:34 UTC by Vincent Danen
Modified: 2021-10-20 10:43 UTC (History)
16 users (show)

Fixed In Version: python-pip 1.5
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-10-20 10:43:51 UTC
Embargoed:

Attachments (Terms of Use)

Description Vincent Danen 2014-02-18 22:34:14 UTC 
The mirroring support (-M, --use-mirrors) was implemented without
any sort of authenticity checks and is downloaded over plaintext
HTTP. Further more by default it will dynamically discover the list of
available mirrors by querying a DNS entry and extrapolating from that
data. It does not attempt to use any sort of method of securing this
querying of the DNS like DNSSEC. Software packages are downloaded over
these insecure links, unpacked, and then typically the setup.py python
file inside of them is executed.

It's a pretty long thread originating here:

http://www.openwall.com/lists/oss-security/2013/08/21/18
Comment 1 Kurt Seifried 2014-11-04 06:12:41 UTC 
Created python-pip tracking bugs for this issue:

Affects: fedora-all [bug 1160134]
Comment 2 Kurt Seifried 2014-11-04 06:12:44 UTC 
Created python-virtualenv tracking bugs for this issue:

Affects: fedora-all [bug 1160135]
Comment 3 Kurt Seifried 2014-11-04 06:13:06 UTC 
Created python-pip tracking bugs for this issue:

Affects: epel-all [bug 1160136]
Comment 4 Kurt Seifried 2014-11-04 06:13:09 UTC 
Created python-virtualenv tracking bugs for this issue:

Affects: epel-all [bug 1160137]
Comment 5 Tomas Hoger 2015-01-14 12:41:08 UTC 
Upstream changelog lists this issue as fixed in upstream version 1.5:

BACKWARD INCOMPATIBLE pip no longer supports the --use-mirrors, -M, and --mirrors flags. The mirroring support has been removed. In order to use a mirror specify it as the primary index with -i or --index-url, or as an additional index with --extra-index-url. (PR #1098, CVE-2013-5123)

https://pip.pypa.io/en/latest/news.html
https://github.com/pypa/pip/pull/1098

Version 1.5 is available in Fedora 21+ and EPEL-7.  Fedora 20 python-pip package uses version 1.4.1.

python-virtualenv also includes copy of pip.  Currently used versions are virtualenv 1.10.1 (EPEL-6 or RHEL-7) which includes pip 1.4.1, and virtualenv 1.11.6 (Fedora 20+) which includes pip 1.5.6.
Comment 6 Fedora Update System 2015-04-21 18:54:50 UTC 
python-virtualenv-12.0.7-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2015-04-21 18:59:35 UTC 
python-virtualenv-12.0.7-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 Fedora Update System 2015-07-20 19:47:22 UTC 
python-pip-7.1.0-1.el7 has been pushed to the Fedora EPEL 7 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 Fedora Update System 2015-07-20 19:47:41 UTC 
python-pip-7.1.0-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.