High DLA-3876-1 2 CVEs

setuptools - security update

Published Sep 5, 2024 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 11	setuptools	52.0.0-4+deb11u1

Vulnerabilities 2

High 8.8

CVE-2024-6345

Remote Code Execution in pypa/setuptools

A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index …

pypa pypa/setuptools katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi PyPI

Jul 15, 2024
Medium 5.9

CVE-2022-40897

pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS)

Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.

python3 python-pip setuptools setuptools Debian Ubuntu Azure Linux PyPI

Dec 22, 2022