Skip to content
OpenAdvisories
High RHSA-2025:13804 1 CVE

Red Hat Security Advisory: python3.11-setuptools security update

Published Aug 14, 2025 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream python3.11-setuptools 0:65.5.1-2.el8_8.2
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream python3.11-setuptools-wheel 0:65.5.1-2.el8_8.2
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream python3.11-setuptools 0:65.5.1-2.el8_8.2
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream python3.11-setuptools-wheel 0:65.5.1-2.el8_8.2

Vulnerabilities 1

  • High 7.7
    CVE-2025-47273 Public exploit

    setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

    setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to ar…

    pypa setuptools kserve-storage-controller datadog-agent-7.77 Debian Ubuntu Azure Linux Wolfi PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2366982
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_13804.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-47273
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-47273
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-47273
  • article
    https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88
  • article
    https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b
  • article
    https://github.com/pypa/setuptools/issues/4946
  • article
    https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf