CVE-2013-1629: pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity chec...

Security readout for executives and security teams

Old pip versions could download Python packages over unprotected HTTP without verifying package contents. An attacker positioned on the network could alter what pip received during installation and cause code to run. The main business concern is legacy build, deployment, or developer environments using pip before 1.3. Exposure is most likely in old Python environments, legacy CI images, build scripts, or unmanaged developer machines that still use pip before 1.3 or archived system packages. Current pip installations are not identified as affected by the provided sources. Treat this as a legacy supply-chain risk. It is urgent if old build or deployment systems still exist, because compromise during package installation can affect released software. If inventory confirms only modern pip is used, priority drops to documentation and control validation. Mitigation focus: Upgrade pip installations older than 1.3 using current PyPA or vendor guidance.; Remove or rebuild legacy CI and deployment images containing pre-1.3 pip.; Avoid dependency installation on untrusted networks until vulnerable tooling is replaced..

Prepared

Jun 14, 2026, 21:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.