Important: python3.11-setuptools security update
Summary
ALSA-2024:5279: Important: python3.11-setuptools security update. Affects python3.11-setuptools versions < 65.5.1-2.el9_4.1. Fixed in 65.5.1-2.el9_4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Setuptools is a collection of enhancements to the Python 3 distutils that allow you to more easily build and distribute Python 3 packages, especially ones that have dependencies on other packages. This package also contains the runtime components of setuptools, necessary to execute the software that requires pkg_resources.
Vulnerability Detail
The vulnerability (CVE-2024-6345) in pypa/setuptools allows for remote code execution via download functions in the package_index module. This can potentially lead to unauthorized access, data breaches, and the execution of malicious code on affected systems.
How To Fix
Minimum fixed version
65.5.1-2.el9_4.1
This is the first release that contains the fix.
sudo dnf update python3.11-setuptoolsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The python3.11-setuptools package is vulnerable to remote code execution. It is crucial to update to version 65.5.1-2.el9_4.1 or later to mitigate the risk of unauthorized access and potential data breaches.
See every vulnerability recorded for python3.11-setuptools →
FAQ
Setuptools is a collection of enhancements to the Python 3 distutils that simplify the building and distribution of Python 3 packages.
The vulnerability allows for remote code execution, which can lead to unauthorized access, data breaches, and the execution of malicious code on affected systems.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and it will alert you in real-time.
No specific workarounds have been provided for this vulnerability. It is recommended to update the affected package to the latest version.
You can find more details about this vulnerability, including the impact, CVSS score, and acknowledgments, on the CVE page: CVE-2024-6345.
Related vulnerabilities
Recent vulnerabilities recorded for python3.11-setuptools.
