Moderate Security Vulnerability in python3.11-setuptools: Path Traversal Issue
Summary
ALSA-2025:11043: Moderate: python3.11-setuptools security update. Affects python3.11-setuptools versions < 65.5.1-4.el8_10. Fixed in 65.5.1-4.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted, interactive, object-oriented programming language known for its simplicity and versatility. It includes features such as modules, classes, exceptions, and dynamic data types, making it suitable for various applications. The python3.11-setuptools package is essential for packaging Python projects, managing dependencies, and distributing Python code. However, it has been identified to have a security vulnerability that could potentially expose systems to risks.
Vulnerability Detail
The vulnerability identified as CVE-2025-47273 is a Path Traversal vulnerability in the setuptools PackageIndex. This flaw allows an attacker to manipulate file paths, potentially leading to unauthorized access to files outside the intended directory. If exploited, this could compromise the integrity and confidentiality of sensitive data on the system. The vulnerability affects versions prior to 65.5.1-4.el8_10, necessitating immediate attention to mitigate risks.
How To Fix
Minimum fixed version
65.5.1-4.el8_10
This is the first release that contains the fix.
sudo dnf update python3.11-setuptoolsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using the affected functionalities of the setuptools package until the update is applied. Regularly monitor for any suspicious activities or unauthorized access attempts in your application.
Conclusion
The python3.11-setuptools package has a moderate security vulnerability (CVE-2025-47273) that requires immediate attention. Updating to the patched version is crucial to protect your system from potential exploitation. Regular monitoring and using tools like Vulert can help maintain security in your applications.
See every vulnerability recorded for python3.11-setuptools →
FAQ
CVE-2025-47273 is a Path Traversal vulnerability found in the python3.11-setuptools package that could allow attackers to access unauthorized files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could lead to unauthorized access to sensitive files, compromising data integrity and confidentiality.
Yes, a patch is available in version 65.5.1-4.el8_10 of the python3.11-setuptools and python3.11-setuptools-wheel packages.
If immediate updates are not possible, avoid using the affected functionalities and monitor your application for any suspicious activities.
Related vulnerabilities
Recent vulnerabilities recorded for python3.11-setuptools.
