Moderate Security Update for python3.11-setuptools: Path Traversal Vulnerability
Summary
ALSA-2025:13578: Moderate: python3.11-setuptools security update. Affects python3.11-setuptools versions < 65.5.1-4.el9_6. Fixed in 65.5.1-4.el9_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted, interactive, object-oriented programming language known for its simplicity and versatility. It includes features such as modules, classes, exceptions, and dynamic data types, making it suitable for various applications. The python3.11-setuptools package is essential for managing Python packages and dependencies. However, it has been identified to have a vulnerability that could potentially allow unauthorized access to file paths.
Vulnerability Detail
The vulnerability, identified as CVE-2025-47273, is a Path Traversal issue in the setuptools PackageIndex. This flaw allows an attacker to manipulate file paths, potentially leading to unauthorized file access or modification. The vulnerability arises from improper validation of user input, which can be exploited to traverse directories outside the intended scope, posing a significant security risk.
How To Fix
Minimum fixed version
65.5.1-4.el9_6
This is the first release that contains the fix.
sudo dnf update python3.11-setuptoolsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the affected package or avoid using features that rely on the setuptools PackageIndex until the update is applied. Additionally, ensure that your application has proper input validation to mitigate the risk of path traversal attacks.
Conclusion
The python3.11-setuptools package has a moderate security vulnerability that requires immediate attention. By updating to the patched version, users can protect their systems from potential exploitation. It is crucial to stay informed about such vulnerabilities and utilize tools like Vulert for ongoing monitoring.
See every vulnerability recorded for python3.11-setuptools →
FAQ
CVE-2025-47273 is a Path Traversal vulnerability found in the python3.11-setuptools package, which could allow unauthorized access to files on the system.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The risks include unauthorized access to sensitive files, potential data breaches, and exploitation of the system by attackers.
Yes, you can implement input validation and restrict access to the affected package as a temporary measure until the patch is applied.
For detailed information, you can refer to the CVE page associated with CVE-2025-47273 or the advisory provided by AlmaLinux.
Related vulnerabilities
Recent vulnerabilities recorded for python3.11-setuptools.
