REDHAT-BUG-2297771: Code Injection
A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2297771?
The severity of REDHAT-BUG-2297771 is categorized as critical due to its potential for remote code execution.
How do I fix REDHAT-BUG-2297771?
To fix REDHAT-BUG-2297771, upgrade pypa/setuptools to a version higher than 69.1.1.
What versions of setuptools are affected by REDHAT-BUG-2297771?
REDHAT-BUG-2297771 affects pypa/setuptools versions up to and including 69.1.1.
Is remote code execution possible with REDHAT-BUG-2297771?
Yes, remote code execution is possible with REDHAT-BUG-2297771 through its download functions.
What component of setuptools is vulnerable in REDHAT-BUG-2297771?
The package_index module of pypa/setuptools is the vulnerable component in REDHAT-BUG-2297771.