CVE-2013-5123: Insecure DNS Querying and Authenticity Checks in Python Pip
Summary
CVE-2013-5123: The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks. Affects pip versions < 1.5. Fixed in 1.5. How to fix ↓
Also tracked for
- python-pip · Debian:11
The same CVE-2013-5123 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python Pip is a package management system used to install and manage software packages written in Python. It allows users to easily install, upgrade, and remove Python packages. Pip is widely used in the Python ecosystem and is an essential tool for developers and system administrators.
Vulnerability Detail
The mirroring support (-M, --use-mirrors) in Python Pip before version 1.5 uses insecure DNS querying and authenticity checks. This vulnerability allows attackers to perform man-in-the-middle attacks. By intercepting the DNS queries made by Pip, an attacker can redirect the package download requests to a malicious mirror server. This can lead to the installation of compromised or malicious packages, potentially compromising the integrity and security of the Python environment.
How To Fix
Latest published version: 26.2.2 as of 22 Oct 2026
pip install --upgrade "pip==26.2.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5
This is the first release that contains the fix.
pip install --upgrade "pip==1.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade Pip to the fixed version to mitigate the risk of man-in-the-middle attacks.
Conclusion
In conclusion, the vulnerability (CVE-2013-5123) in Python Pip allows for man-in-the-middle attacks due to insecure DNS querying and authenticity checks. To mitigate this risk, it is essential to upgrade Pip to version 1.5 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pip →
FAQ
Python Pip is a package management system used to install and manage software packages written in Python.
This vulnerability allows attackers to perform man-in-the-middle attacks, potentially leading to the installation of compromised or malicious packages.
To fix this vulnerability, upgrade Python Pip to version 1.5 or later by running 'pip install --upgrade pip'.
There is no known workaround for this vulnerability. It is crucial to upgrade Pip to the fixed version.
You can find more information about this vulnerability in the Python Pip advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/pip/PYSEC-2019-160.yaml
Related vulnerabilities
Recent vulnerabilities recorded for pip.
