| Package | Affected versions | Patched versions |
|---|---|---|
| setuptools | < 0.7 | 0.7 |
| setuptools | = 0.6.40= 0.6.41= 0.6.42= 0.6.43= 0.6.44= 0.6.45= 0.6.46= 0.6.47= 0.6.48= 0.6.49≤ 0.7b4 |
easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free