Search for packages
| purl | pkg:deb/debian/python-virtualenv@1.7.1.2-2 |
| Next non-vulnerable version | 1.11.6+ds-1 |
| Latest non-vulnerable version | 21.2.0+ds-1 |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-ezkx-6k4g-n3az
Aliases: CVE-2013-1629 GHSA-g3p5-fjj9-h8gj PYSEC-2013-8 |
pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-6crp-q47m-w7dh | virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/. |
CVE-2011-4617
GHSA-3jhc-wjqf-5f2c PYSEC-2011-23 |