GHSA-f594-f3v3-g649

Source

https://github.com/advisories/GHSA-f594-f3v3-g649

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f594-f3v3-g649/GHSA-f594-f3v3-g649.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-f594-f3v3-g649

Aliases

CVE-2013-1630
PYSEC-2013-10

Published

2022-05-17T05:03:06Z

Modified

2024-10-14T18:36:24Z

Severity

8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

pyshop vulnerable to man-in-the-middle attacks due to using HTTP to retrieve packages from the PyPI repository

Details

pyshop before 0.7.1 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a download operation.

Database specific

{
    "cwe_ids":  [
        "CWE-20"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-04-30T14:39:09Z",
    "nvd_published_at":  "2013-08-06T02:52:00Z",
    "severity":  "HIGH"
}

References

Affected packages

PyPI / pyshop

Package

Name: pyshop; View open source insights on deps.dev
Purl: pkg:pypi/pyshop

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.7.1

Affected versions

0.*

0.1

0.2

0.3

0.4

0.5

0.6

0.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f594-f3v3-g649/GHSA-f594-f3v3-g649.json"