Moderate Security Vulnerability in python-setuptools: Path Traversal Issue
Summary
RLSA-2025:9940: Moderate: python-setuptools security update. Affects python-setuptools versions < 0:69.0.3-12.el10_0. Fixed in 0:69.0.3-12.el10_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-setuptools is a widely used package in the Python ecosystem that facilitates the packaging of Python projects. It provides tools for building, packaging, and distributing Python code, making it essential for developers. However, it has recently been identified to have a security vulnerability that could potentially allow unauthorized access to the file system.
Vulnerability Detail
The vulnerability, identified as CVE-2025-47273, is a Path Traversal vulnerability in the setuptools PackageIndex. This issue arises from improper validation of user input, allowing an attacker to manipulate file paths and access sensitive files outside the intended directory. The ramifications of this vulnerability could lead to unauthorized data exposure and compromise the integrity of the system. The CVSS score for this vulnerability is 7.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
0:69.0.3-12.el10_0
This is the first release that contains the fix.
sudo dnf update python-setuptoolsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the affected directories and monitor file access logs for any suspicious activity until the package is updated.
Conclusion
In summary, the python-setuptools package has a moderate security vulnerability that could lead to unauthorized file access. It is crucial for users to update to the patched version to mitigate risks. Temporary workarounds can be employed until the update is applied.
See every vulnerability recorded for python-setuptools →
FAQ
The vulnerability is a Path Traversal issue that allows attackers to access files outside the intended directory.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.1, indicating a moderate severity level.
If immediate updates are not possible, restrict access to affected directories and monitor logs for any unauthorized access.
The Rocky Enterprise Software Foundation and Red Hat are responsible for addressing this vulnerability and providing updates.
Related vulnerabilities
Recent vulnerabilities recorded for python-setuptools.
