CVE-2013-5123: debian debian_linux Improper Authentication
CVSS: 5.9v3.1MediumModified
AliasesMGASA-2015-0180GHSA-c5h8-cq4v-cvfmPYSEC-2019-160UBUNTU-CVE-2013-5123DEBIAN-CVE-2013-5123
Published 05-11-2019Last modified 06-08-2024
Vulnerability summary
CVE-2013-5123 is a medium (CVSS 5.9) Improper Authentication vulnerability in debian debian_linux. EPSS estimates a 7.99% chance of exploitation in the next 30 days, higher than 94.7% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
5.9/10
010
Medium · v3.1 (NVD)EPSS score
7.99%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1exploit-database
Advisory lineage
Upstream 0 · Downstream 4 · Duplicates 1 · Related 4Timeline
- 05-11-2019PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.
CVSS metrics
6 scores · 4 sources · 3 versionsHigh 8.2Preferred score · OSV · Pypi (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NSourcesSingle source
Medium 5.9Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NSourcesAll 4 agree
- OSV · PypiEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
7.99%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
0.00 pp
From 7.99% on 18-09-2026
18-09-202618-10-2026
EPSS score7.99%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundphlyLabs phlyMail Lite 4.03.04 - 'go' Open Redirect
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Debian2 products
- python-pip< 1.4.1-1
- debian_linuxEOL8.0 | 9.0 | 10.0
Mageia2 products
- python-pip< 6.1.1-1.mga4
- python-virtualenv< 12.1.1-1.mga4
Redhat2 products
- openshift1.0 | 2.0
- software_collectionsna
Fedoraproject1 product
- fedoraEOL20 | 21
Pypa1 product
- pip< 1.5
PyPI1 product
- pip< 1.5
Ubuntu1 product
- python-pip< 1.5.4-1ubuntu4 | < 8.1.1-2ubuntu0.4
Virtualenv1 product
- virtualenv12.0.7
8 vendors · 11 products
References
18 links
- bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-5123X Refsource MISCIssue TrackingPatchThird Party AdvisoryWEBREPORT
- bugzilla.suse.com/show_bug.cgi?id=CVE-2013-5123X Refsource MISCIssue TrackingThird Party AdvisoryWEBREPORT
- lists.fedoraproject.org/pipermail/package-announce/2015-April/155248.htmlX Refsource MISCMailing ListThird Party AdvisoryWEB
- lists.fedoraproject.org/pipermail/package-announce/2015-April/155291.htmlX Refsource MISCMailing ListThird Party AdvisoryWEB
- www.openwall.com/lists/oss-security/2013/08/21/17X Refsource MISCMailing ListThird Party AdvisoryWEB
- www.openwall.com/lists/oss-security/2013/08/21/18X Refsource MISCMailing ListThird Party AdvisoryWEBREPORT
