CVE-2022-40897: Input Validation
Pypa Setuptools is vulnerable to a denial of service, caused by improper input validation. By sending request with a specially crafted regular expression, an remote attacker could exploit this vulnerability to cause a denial of service.
Other sources
Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in packageindex.py.
— Red Hat
Python Packaging Authority (PyPA)'s setuptools is a library designed to facilitate packaging Python projects. Setuptools version 65.5.0 and earlier could allow remote attackers to cause a denial of service by fetching malicious HTML from a PyPI package or custom PackageIndex page due to a vulnerable Regular Expression in packageindex. This has been patched in version 65.5.1.
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-40897?
CVE-2022-40897 is a vulnerability in Python Packaging Authority (PyPA) setuptools before 65.5.1 that allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page due to improper input validation.
How does CVE-2022-40897 impact Python Setuptools?
CVE-2022-40897 affects Python Setuptools versions prior to 65.5.1 and can be exploited to cause a denial of service by sending malicious HTML in a crafted package or custom PackageIndex page.
How does CVE-2022-40897 impact IBM Cognos Dashboards on Cloud Pak for Data?
CVE-2022-40897 impacts IBM Cognos Dashboards on Cloud Pak for Data up to version 4.7.0 and can be exploited to cause a denial of service by sending malicious HTML in a crafted package or custom PackageIndex page.
How can I fix CVE-2022-40897?
To fix CVE-2022-40897, you should update Python Setuptools to version 65.5.1 or later.
Are there any references for CVE-2022-40897?
Yes, you can find references for CVE-2022-40897 at the following links: [Link 1](https://exchange.xforce.ibmcloud.com/vulnerabilities/243028), [Link 2](https://www.ibm.com/support/pages/node/7031207), [Link 3](https://github.com/pypa/setuptools/blob/fe8a98e696241487ba6ac9f91faa38ade939ec5d/setuptools/package_index.py#L200).