Moderate Security Vulnerability in python3.12-setuptools: Path Traversal Issue
Summary
RLSA-2025:12834: Moderate: python3.12-setuptools security update. Affects python3.12-setuptools versions < 0:68.2.2-5.el9_6. Fixed in 0:68.2.2-5.el9_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3.12-setuptools is a package used for the installation and distribution of Python packages. It provides a range of functionalities including dependency management, package building, and installation. This package is essential for developers working with Python, as it simplifies the process of managing libraries and modules. However, it has been identified to have a security vulnerability that could potentially allow unauthorized access to the file system.
Vulnerability Detail
The vulnerability, identified as CVE-2025-47273, is a Path Traversal vulnerability found in the setuptools package. This flaw allows attackers to manipulate file paths, potentially leading to unauthorized access to sensitive files on the system. The ramifications of this vulnerability can be severe, as it could allow an attacker to read or modify files outside the intended directory, compromising the integrity and confidentiality of the system. The CVSS score for this vulnerability is 7.1, indicating a moderate level of risk.
How To Fix
Minimum fixed version
0:68.2.2-5.el9_6
This is the first release that contains the fix.
sudo dnf update python3.12-setuptoolsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not possible, consider restricting access to the affected package or monitoring its usage closely until the update can be applied. Additionally, ensure that your application does not expose sensitive file paths to untrusted users.
Conclusion
In summary, the python3.12-setuptools package has a moderate security vulnerability (CVE-2025-47273) that could allow unauthorized access to the file system. It is crucial to update to the patched version to mitigate this risk. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for python3.12-setuptools →
FAQ
CVE-2025-47273 is a Path Traversal vulnerability in the python3.12-setuptools package that allows attackers to access files outside of the intended directory.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include unauthorized access to sensitive files, which can compromise the integrity and confidentiality of your system.
If you cannot update the package immediately, consider restricting access to the affected package and monitoring its usage closely.
More information can be found on the CVE page associated with CVE-2025-47273, which details the security issue and its implications.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12-setuptools.
