Moderate Security Vulnerability in python3.11-setuptools: Path Traversal Issue
Summary
RLSA-2025:13578: Moderate: python3.11-setuptools security update. Affects python3.11-setuptools versions < 0:65.5.1-4.el9_6. Fixed in 0:65.5.1-4.el9_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3.11-setuptools is a package management library for Python that simplifies the process of packaging Python projects and managing dependencies. It provides tools for building, packaging, and distributing Python code. However, it is susceptible to a path traversal vulnerability that can potentially allow unauthorized access to the filesystem.
Vulnerability Detail
The vulnerability, identified as CVE-2025-47273, arises from improper validation of file paths in the setuptools package index. This flaw can be exploited by attackers to manipulate file paths, leading to unauthorized file access or modification. The potential ramifications include data leakage, unauthorized access to sensitive files, and system compromise, making it critical for users to address this issue promptly.
How To Fix
Minimum fixed version
0:65.5.1-4.el9_6
This is the first release that contains the fix.
sudo dnf update python3.11-setuptoolsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the permissions of the directories where setuptools operates, thereby reducing the risk of exploitation until the package is updated. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The python3.11-setuptools package has a moderate security vulnerability (CVE-2025-47273) that can lead to serious consequences if not addressed. Users are advised to update to the latest patched version to mitigate risks. Utilizing tools like Vulert can help in monitoring vulnerabilities effectively.
See every vulnerability recorded for python3.11-setuptools →
FAQ
CVE-2025-47273 is a path traversal vulnerability in the python3.11-setuptools package that can allow attackers to access unauthorized files on the system.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized access to sensitive files, data leakage, and potential system compromise.
Yes, a patched version of python3.11-setuptools is available. Users should update to version 0:65.5.1-4.el9_6.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for python3.11-setuptools.
