Moderate: python-setuptools security update
Summary
ALSA-2023:0952: Moderate: python-setuptools security update. Affects python3-setuptools versions < 53.0.0-10.el9_1.1. Fixed in 53.0.0-10.el9_1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-setuptools package is a collection of enhancements to Python distribution utilities that enable convenient building and distribution of Python packages. It is widely used in the Python ecosystem for package management and distribution.
Vulnerability Detail
The vulnerability (CVE-2022-40897) in the python-setuptools package is a Regular Expression Denial of Service (ReDoS) issue in the package_index.py file. This vulnerability can be exploited by an attacker to cause a denial of service by sending specially crafted input to the affected application. The impact of this vulnerability is considered moderate.
How To Fix
Minimum fixed version
53.0.0-10.el9_1.1
This is the first release that contains the fix.
sudo dnf update python3-setuptoolsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update the python-setuptools package to the fixed version.
Conclusion
The python-setuptools package has a moderate security vulnerability (CVE-2022-40897) that can be exploited to cause a denial of service. To mitigate this vulnerability, it is recommended to update the package to version 53.0.0-10.el9_1.1 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for python3-setuptools →
FAQ
Python-setuptools is a package that provides enhancements to Python distribution utilities for easy building and distribution of Python packages.
The vulnerability can be exploited to cause a denial of service by sending specially crafted input to the affected application.
You can fix this vulnerability by updating the python-setuptools package to version 53.0.0-10.el9_1.1 or later.
There is no specific workaround mentioned for this vulnerability. Updating the package to the fixed version is the recommended solution.
You can find more information about this vulnerability in the CVE page (CVE-2022-40897) listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for python3-setuptools.
