CVE-2013-1630: pyshop before 0.7.1 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity...

Security readout for executives and security teams

CVE-2013-1630 affects pyshop before 0.7.1. It could fetch Python packages over plain HTTP without verifying package integrity, allowing a network attacker to substitute malicious content. Business urgency depends on whether legacy pyshop is still used in build or package distribution workflows. Exposure is most likely in legacy environments still running pyshop before 0.7.1 as a Python package index, cache, or mirror component. Evidence in the bundle does not identify CPEs, vendors, or downstream products. Prioritize remediation if pyshop is part of production build, deployment, or internal package distribution. The vulnerability can affect software supply chain trust, but urgency is lower where pyshop is absent or retired. Mitigation focus: Upgrade pyshop to 0.7.1 or later where still deployed.; Check current pyshop vendor guidance before relying on unsupported legacy software.; Require HTTPS for upstream package retrieval wherever configurable..

Prepared

Jun 14, 2026, 21:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.