Moderate Security Update: python3.12-setuptools Path Traversal Vulnerability
Summary
ALSA-2025:12834: Moderate: python3.12-setuptools security update. Affects python3.12-setuptools versions < 68.2.2-5.el9_6. Fixed in 68.2.2-5.el9_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, and dynamic data types. The python3.12-setuptools package is essential for managing Python packages and dependencies, providing tools for packaging Python projects. However, it has been identified to have a security vulnerability that could allow unauthorized access to the file system.
Vulnerability Detail
The vulnerability, identified as CVE-2025-47273, is a Path Traversal issue in the setuptools PackageIndex. This flaw allows an attacker to manipulate file paths, potentially leading to unauthorized file access on the system. If exploited, this could compromise sensitive data or allow for further attacks on the system. The vulnerability affects versions of the package prior to 68.2.2-5.el9_6.
How To Fix
Minimum fixed version
68.2.2-5.el9_6
This is the first release that contains the fix.
sudo dnf update python3.12-setuptoolsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the permissions of the affected package or avoid using the functionalities that involve the PackageIndex until the package is updated. However, this is not a permanent solution and updating the package is strongly advised.
Conclusion
The python3.12-setuptools package has a moderate security vulnerability that could allow unauthorized file access. It is crucial to update to the patched version to ensure the security of your system. Utilize tools like Vulert to monitor for vulnerabilities in your applications.
See every vulnerability recorded for python3.12-setuptools →
FAQ
CVE-2025-47273 is a Path Traversal vulnerability in the python3.12-setuptools package that allows attackers to access unauthorized files on the system.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Exploitation of this vulnerability could lead to unauthorized access to sensitive files, potentially compromising the security of the system.
While limiting permissions on the affected package can help, it is not a permanent fix. Updating to the patched version is the recommended solution.
For more details, refer to the CVE page associated with CVE-2025-47273 or check the advisory from AlmaLinux.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12-setuptools.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
