Moderate Security Update: Path Traversal Vulnerability in python-setuptools
Summary
ALSA-2025:11036: Moderate: python-setuptools security update. Affects platform-python-setuptools versions < 39.2.0-9.el8_10. Fixed in 39.2.0-9.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted programming language known for its object-oriented features, dynamic typing, and extensive libraries. The python-setuptools package is essential for packaging Python projects, enabling easy installation and distribution of Python software. However, it has recently been identified to have a vulnerability that could allow unauthorized access to file paths.
Vulnerability Detail
The vulnerability, identified as CVE-2025-47273, is a Path Traversal vulnerability in the setuptools package. This flaw allows attackers to manipulate file paths, potentially leading to unauthorized file access on the system. If exploited, this could compromise sensitive data or allow malicious code execution, posing a significant risk to applications relying on this package.
How To Fix
Minimum fixed version
39.2.0-9.el8_10
This is the first release that contains the fix.
sudo dnf update platform-python-setuptoolsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the affected package by modifying permissions or using a different version of setuptools that does not contain this vulnerability. However, the best course of action is to apply the patch as soon as possible.
Conclusion
The python-setuptools package has a moderate security vulnerability that needs immediate attention. By updating to the patched version, users can protect their applications from potential exploitation. Regular monitoring for vulnerabilities is essential for maintaining software security.
See every vulnerability recorded for platform-python-setuptools →
FAQ
CVE-2025-47273 is a Path Traversal vulnerability found in the python-setuptools package, which could allow unauthorized access to file paths.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability could lead to unauthorized access to sensitive files or execution of malicious code, posing a significant security risk.
Yes, you can restrict access to the affected package or use a different version of setuptools that does not have this vulnerability.
It is advisable to regularly check for vulnerabilities in your packages, especially after updates or when new vulnerabilities are disclosed.
Related vulnerabilities
Recent vulnerabilities recorded for platform-python-setuptools.
