CVE-2013-5123: Improper Authentication in pip
Summary
CVE-2013-5123: Improper Authentication in pip. Affects pip versions < 1.5. Fixed in 1.5. How to fix ↓
Also tracked for
- python-pip · Debian:11
The same CVE-2013-5123 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Pip is a package management system used to install and manage software packages written in Python. It is a widely used tool in the Python ecosystem and allows users to easily install, upgrade, and remove Python packages. However, prior to version 1.5, Pip had a vulnerability related to its mirroring support (-M, --use-mirrors) feature. This vulnerability allowed attackers to perform man-in-the-middle attacks by exploiting insecure DNS querying and authenticity checks.
Vulnerability Detail
The vulnerability in Pip's mirroring support feature allowed attackers to intercept and modify package downloads, potentially leading to the installation of malicious or tampered packages. By manipulating DNS queries and bypassing authenticity checks, an attacker could replace legitimate packages with their own versions, which may contain malicious code or compromise the integrity of the system. This could result in unauthorized access, data leakage, or other security breaches.
How To Fix
Latest published version: 26.2.2 as of 22 Oct 2026
pip install --upgrade "pip==26.2.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5
This is the first release that contains the fix.
pip install --upgrade "pip==1.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Pip is not immediately feasible, a workaround is to avoid using the mirroring support feature (-M, --use-mirrors) or to ensure that package downloads are performed over secure and trusted connections. This can be achieved by specifying the package index URL directly or by using the --index-url flag with a trusted repository. For example:
pip install --index-url https://pypi.org/simple/ package_name
Conclusion
In conclusion, the vulnerability in Pip's mirroring support feature could allow attackers to compromise the integrity of package downloads and potentially install malicious code. It is crucial to upgrade Pip to version 1.5 or later to mitigate this vulnerability. Alternatively, users can follow the provided workarounds to minimize the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pip →
FAQ
Pip is a package management system used to install and manage software packages written in Python.
The mirroring support feature in Pip allows users to download packages from a mirror instead of the default package index.
The vulnerability allows attackers to perform man-in-the-middle attacks and potentially install malicious or tampered packages.
The recommended fix is to upgrade Pip to version 1.5 or later.
Yes, users can avoid using the mirroring support feature or ensure secure package downloads from trusted sources.
Related vulnerabilities
Recent vulnerabilities recorded for pip.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
