Critical Vulnerability in Python Packaging Authority's setuptools: Denial of Service Risk
Summary
UBUNTU-CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. Affects python-pip versions < 1.5.4-1ubuntu4+esm2. Fixed in 1.5.4-1ubuntu4+esm2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Setuptools is a widely used package development and distribution tool for Python. It simplifies the process of packaging Python projects by providing functionalities such as dependency management and installation. However, certain versions of setuptools are vulnerable to a denial of service (DoS) attack due to a flaw in how it processes HTML content in package indexes.
Vulnerability Detail
The vulnerability identified as CVE-2022-40897 affects setuptools versions prior to 65.5.1. It allows remote attackers to exploit a Regular Expression Denial of Service (ReDoS) through crafted HTML in a package or a custom PackageIndex page. This can lead to significant performance degradation or application crashes, impacting the availability of services relying on affected versions of setuptools.
How To Fix
Minimum fixed version
1.5.4-1ubuntu4+esm2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-pipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can avoid using untrusted package indexes or limit the use of custom PackageIndex pages until the package is updated. Additionally, ensure that your application validates and sanitizes any HTML content processed by setuptools.
Conclusion
CVE-2022-40897 poses a significant risk to applications using vulnerable versions of setuptools, allowing for denial of service attacks. It is crucial to update to the latest version to ensure the security and availability of your applications. Utilize tools like Vulert to monitor for vulnerabilities in your software.
See every vulnerability recorded for python-pip →
FAQ
CVE-2022-40897 is a vulnerability in setuptools that allows for denial of service attacks through crafted HTML content.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Setuptools versions prior to 65.5.1 are affected by this vulnerability.
The CVSS score for CVE-2022-40897 is 5.9, indicating a medium severity level.
If immediate updates are not possible, consider implementing workarounds such as avoiding untrusted package indexes and sanitizing HTML content.
Related vulnerabilities
Recent vulnerabilities recorded for python-pip.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
