python-virtualenv: insecure software download
| Package(s): | python-virtualenv |
CVE #(s): | CVE-2013-5123
|
| Created: | April 22, 2015 |
Updated: | April 22, 2015 |
| Description: |
From the Red Hat bugzilla:
The mirroring support (-M, --use-mirrors) was implemented without
any sort of authenticity checks and is downloaded over plaintext
HTTP. Further more by default it will dynamically discover the list of
available mirrors by querying a DNS entry and extrapolating from that
data. It does not attempt to use any sort of method of securing this
querying of the DNS like DNSSEC. Software packages are downloaded over
these insecure links, unpacked, and then typically the setup.py python
file inside of them is executed. |
| Alerts: |
|
