Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 11 Mar 2013 15:32:52 -0400
From: Donald Stufft <>
Subject: CVE Request: MD5 used for Download verification

I'd like to request CVE(s?) for the Python software: setuptools[1] and distribute[2]

Setuptools (and it's fork distribute) utilize MD5 in order to verify that a download has not been tampered with. 

As far as I know this affects all versions of both setuptools and distribute. 

It also affects zc.buildout[3] which utilizes the md5 checking from distribute. It does not affect pip[4] as pip has grown it's own handling code outside of setuptools/distribute to allow stronger hashes.


Donald Stufft
PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA

Download attachment "signature.asc" of type "application/pgp-signature" (842 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.