CVE-2013-5123

Vulnerability

Details

The mirroring support in Python pip versions before 1.5, enabled via the -M or --use-mirrors options, employed insecure DNS querying and lacked proper authenticity checks [1][2]. This design flaw allowed an attacker to perform man-in-the-middle attacks by spoofing DNS responses or intercepting communications between pip and mirror servers [3][4].

Exploitation

An attacker positioned on the network path between the pip client and mirror hosts could manipulate DNS queries to redirect requests to a malicious server [3]. No cryptographic validation of mirror identity or package signatures was performed, meaning any compromised or fake mirror could serve arbitrary code [4]. The attack requires no prior authentication and can be triggered during any pip installation or upgrade using mirrors.

Impact

A successful man-in-the-middle attack could lead to the installation of arbitrary Python packages, resulting in remote code execution or system compromise [1]. This vulnerability poses significant risk to automated deployment pipelines and any environment relying on pip with mirror support.

Mitigation

The issue was addressed in pip version 1.5 by deprecating the --use-mirrors flag and improving the security of mirror interactions [2]. Users are strongly advised to upgrade to pip 1.5 or later and avoid using mirroring without HTTPS and certificate verification.