Moderate: python-setuptools security update
Summary
ALSA-2023:0835: Moderate: python-setuptools security update. Affects platform-python-setuptools versions < 39.2.0-6.el8_7.1. Fixed in 39.2.0-6.el8_7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The python-setuptools package is a collection of enhancements to Python distribution utilities that facilitate the building and distribution of Python packages. It provides various tools and functionalities to simplify the packaging process.
Vulnerability Detail
The vulnerability identified in the python-setuptools package is a Regular Expression Denial of Service (ReDoS) in the package_index.py file. This vulnerability, tracked as CVE-2022-40897, can be exploited by an attacker to cause a denial of service by sending specially crafted input to the affected application. The impact of this vulnerability can result in excessive CPU usage and potentially disrupt the availability of the application.
How To Fix
Minimum fixed version
39.2.0-6.el8_7.1
This is the first release that contains the fix.
sudo dnf update platform-python-setuptoolsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update to ensure the protection of the application.
Conclusion
In conclusion, the python-setuptools package is affected by a Regular Expression Denial of Service (ReDoS) vulnerability. To mitigate this issue, it is recommended to update the package to the latest version. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for platform-python-setuptools →
FAQ
Python-setuptools is a package that provides enhancements to Python distribution utilities, making it easier to build and distribute Python packages.
A Regular Expression Denial of Service (ReDoS) vulnerability occurs when a regular expression pattern can be manipulated in a way that causes the matching algorithm to exhibit exponential time complexity. This can lead to a denial of service by consuming excessive CPU resources.
The impact of this vulnerability can result in excessive CPU usage and potentially disrupt the availability of the application.
To fix this vulnerability, update the python-setuptools package to version 39.2.0-6.el8_7.1 or later.
No, there is no known workaround for this vulnerability. It is crucial to apply the security update.
Related vulnerabilities
Recent vulnerabilities recorded for platform-python-setuptools.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
