Moderate Security Update for python3-setuptools: Path Traversal Vulnerability
Summary
ALSA-2025:9940: Moderate: python-setuptools security update. Affects python3-setuptools versions < 69.0.3-12.el10_0. Fixed in 69.0.3-12.el10_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a versatile, interpreted programming language known for its object-oriented features, dynamic typing, and extensive libraries. The python3-setuptools package is essential for packaging Python projects, facilitating the installation of dependencies, and managing package distributions. However, it has recently been identified to have a security vulnerability that could potentially allow unauthorized access to file paths.
Vulnerability Detail
The vulnerability, identified as CVE-2025-47273, is a Path Traversal vulnerability in the setuptools PackageIndex. This flaw allows an attacker to manipulate file paths, potentially leading to unauthorized file access or modification. The implications of this vulnerability can be severe, as it may expose sensitive data or allow for further exploitation of the system.
How To Fix
Minimum fixed version
69.0.3-12.el10_0
This is the first release that contains the fix.
sudo dnf update python3-setuptoolsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the affected package by modifying permissions or using a different package manager that does not include the vulnerable version. However, updating to the patched version is the best long-term solution.
Conclusion
In summary, the python3-setuptools package has a moderate security vulnerability that requires immediate attention. Updating to the latest patched version is crucial to protect your system from potential exploitation. Utilize tools like Vulert to monitor your applications for vulnerabilities effectively.
See every vulnerability recorded for python3-setuptools →
FAQ
The vulnerability is a Path Traversal issue that allows unauthorized access to file paths within the python3-setuptools package.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failure to address this vulnerability could lead to unauthorized access to sensitive files, data breaches, or further exploitation of your system.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If immediate updates are not possible, consider implementing access restrictions or using alternative packages until you can apply the necessary updates.
Related vulnerabilities
Recent vulnerabilities recorded for python3-setuptools.
