Skip to content
OpenAdvisories
Medium USN-5817-1 1 CVE

python-setuptools, setuptools vulnerability

Published Jan 23, 2023 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

Sebastian Chnelik discovered that setuptools incorrectly handled
certain regex inputs. An attacker could possibly use this issue
to cause a denial of service.

Fixed packages 7

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS python-setuptools 39.0.1-2ubuntu0.1
Ubuntu · 20.04 LTS 20.04:LTS python-setuptools 44.0.0-2ubuntu0.1
Ubuntu · 20.04 LTS 20.04:LTS setuptools 45.2.0-1ubuntu0.1
Ubuntu · 22.04 LTS 22.04:LTS python-setuptools 44.1.1-1.2ubuntu0.22.04.1
Ubuntu · 22.04 LTS 22.04:LTS setuptools 59.6.0-1.2ubuntu0.22.04.1
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS python-setuptools 3.3-1ubuntu2+esm1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS python-setuptools 20.7.0-1ubuntu0.1~esm1

Vulnerabilities 1

  • Medium 5.9
    CVE-2022-40897

    pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS)

    Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.

    python3 python-pip setuptools setuptools Debian Ubuntu Azure Linux PyPI

References

  • report
    https://ubuntu.com/security/CVE-2022-40897