Important: python3.12-setuptools security update
Summary
ALSA-2024:5531: Important: python3.12-setuptools security update. Affects python3.12-setuptools versions < 68.2.2-4.el8_10. Fixed in 68.2.2-4.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Setuptools is a collection of enhancements to the Python 3 distutils that allow you to more easily build and distribute Python 3 packages, especially ones that have dependencies on other packages. This package also contains the runtime components of setuptools, necessary to execute the software that requires pkg_resources.
Vulnerability Detail
The vulnerability (CVE-2024-6345) in pypa/setuptools allows for remote code execution via download functions in the package_index module. This can potentially lead to unauthorized access, data breaches, and the execution of malicious code on the affected system.
How To Fix
Minimum fixed version
68.2.2-4.el8_10
This is the first release that contains the fix.
sudo dnf update python3.12-setuptoolsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the affected package to the fixed version as soon as possible.
Conclusion
In conclusion, the python3.12-setuptools package is vulnerable to a remote code execution vulnerability. It is crucial to update the package to version 68.2.2-4.el8_10 or later to mitigate the risk of unauthorized access and potential malicious activities.
See every vulnerability recorded for python3.12-setuptools →
FAQ
Setuptools is a collection of enhancements to the Python 3 distutils that simplify the process of building and distributing Python packages.
The vulnerability allows for remote code execution, which can lead to unauthorized access, data breaches, and the execution of malicious code on the affected system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and it will alert you in real-time.
Yes, a security update for python3.12-setuptools is available. It is recommended to update to version 68.2.2-4.el8_10 or later.
There are no known workarounds for this vulnerability. Updating the affected package is the only recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12-setuptools.
