[ GLSA 201310-09 ] Setuptools: Man-in-the-Middle attack

[GLSA]

Gentoo Linux Security Advisory

Title: Setuptools: Man-in-the-Middle attack (GLSA 201310-09)
Severity: normal
Exploitable: remote
Date: October 10, 2013
Bug(s): #479964
ID: 201310-09

Synopsis

A vulnerability in Setuptools could allow remote attackers to
perform man-in-the-middle attacks.


Background

Setuptools is a manager for Python packages.

Affected Packages

Package: dev-python/setuptools
Vulnerable: < 0.8-r1
Unaffected: >= 0.8-r1
Architectures: All supported architectures


Description

Setuptools does not check the integrity of downloaded Python packages.

Impact

A remote attacker could perform man-in-the-middle attacks to execute
arbitrary code with the privileges of the process.


Workaround

There is no known workaround at this time.

Resolution

All Setuptools users should upgrade to the latest version: