Re: CVE Request: Insecure Software Download in pip

[Donald Stufft <donald () stufft io>]

On Jul 31, 2013, at 4:11 AM, Kurt Seifried <kseifried () redhat com> wrote:

> Signed PGP part
>
> Ok I have no info on that CVE, is it embargoed? I can't find it in
> google after a quick search. I need to see that one before I can
> assign anything. As for the reserved thing:
>
> http://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures#Description

If it's embargo'd it's news to me. The details (I assume) are here https://bugzilla.redhat.com/show_bug.cgi?id=968059

As far as I know none of the pip maintainers requested it. I assume (going by the bugzilla) that CVE is for the fact 
pip didn't use TLS or any other authentication method when downloading from the central index. That was fixed in 1.3 
which was releases March 2013.

I don't know who "owns" that CVE or anything about it. The only reason I even know it exists is the red hat page showed 
up in a google search when I was looking for pip CVE's to match fixes up to. I'm not sure what I can (if anything?) do 
as a pip developer to unreserve it?

-----------------
Donald Stufft
PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail