Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 31 Jul 2013 04:25:49 -0400
From: Donald Stufft <>
Subject: Re: CVE Request: Insecure Software Download in pip

On Jul 31, 2013, at 4:11 AM, Kurt Seifried <> wrote:

> Signed PGP part
> Ok I have no info on that CVE, is it embargoed? I can't find it in
> google after a quick search. I need to see that one before I can
> assign anything. As for the reserved thing:

If it's embargo'd it's news to me. The details (I assume) are here

As far as I know none of the pip maintainers requested it. I assume (going by the bugzilla) that CVE is for the fact pip didn't use TLS or any other authentication method when downloading from the central index. That was fixed in 1.3 which was releases March 2013.

I don't know who "owns" that CVE or anything about it. The only reason I even know it exists is the red hat page showed up in a google search when I was looking for pip CVE's to match fixes up to. I'm not sure what I can (if anything?) do as a pip developer to unreserve it?

Donald Stufft
PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA

Content of type "text/html" skipped

Download attachment "signature.asc" of type "application/pgp-signature" (802 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.