CVE-2024-6345: Remote Code Execution in pypa/setuptools
A vulnerability in the packageindex module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.
Other sources
A vulnerability in the packageindex module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6345?
CVE-2024-6345 has been rated with a high severity due to its potential for remote code execution.
How do I fix CVE-2024-6345?
To mitigate CVE-2024-6345, upgrade the setuptools package to version 70.0.0 or later.
Which versions of setuptools are affected by CVE-2024-6345?
CVE-2024-6345 affects setuptools versions up to and including 69.1.1.
Is there a specific version of setuptools I should use to avoid CVE-2024-6345?
It is recommended to use setuptools version 70.0.0 or higher to avoid CVE-2024-6345.
What is the impact of CVE-2024-6345 on my system?
The impact of CVE-2024-6345 is that it allows an attacker to execute arbitrary code remotely through vulnerable download functions.