CVE-2024-6345: Remote Code Execution in pypa/setuptools
First published: Mon Jul 15 2024(Updated: )
A vulnerability in the `package_index` module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.
Credit: security@huntr.dev security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/setuptools | <70.0.0 | 70.0.0 |
| debian/setuptools | <=52.0.0-4<=66.1.1-1 | 52.0.0-4+deb11u1 74.1.2-2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0
- https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
- https://nvd.nist.gov/vuln/detail/CVE-2024-6345
- https://github.com/pypa/setuptools/pull/4332
- https://github.com/advisories/GHSA-cx63-2mw6-8hw5 (Advisory)
- https://security-tracker.debian.org/tracker/CVE-2024-6345
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6345
- https://launchpad.net/bugs/cve/CVE-2024-6345
- https://ubuntu.com/security/CVE-2024-6345
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2298673
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2298674
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2298672
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2298675
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2298671
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2298676
- https://access.redhat.com/errata/RHSA-2024:5000
- https://access.redhat.com/errata/RHSA-2024:5002
- https://access.redhat.com/errata/RHSA-2024:5040
- https://access.redhat.com/errata/RHSA-2024:5078
- https://access.redhat.com/errata/RHSA-2024:5084
- https://access.redhat.com/errata/RHSA-2024:5137
- https://access.redhat.com/errata/RHSA-2024:5279
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2297771#c15
- https://access.redhat.com/errata/RHSA-2024:5389
- https://access.redhat.com/errata/RHSA-2024:5532
- https://access.redhat.com/errata/RHSA-2024:5531
- https://access.redhat.com/errata/RHSA-2024:5533
- https://access.redhat.com/errata/RHSA-2024:5530
- https://access.redhat.com/errata/RHSA-2024:5534
- https://access.redhat.com/errata/RHSA-2024:5962
- https://access.redhat.com/errata/RHSA-2024:6220
- https://access.redhat.com/errata/RHSA-2024:6311
- https://access.redhat.com/errata/RHSA-2024:6312
- https://access.redhat.com/errata/RHSA-2024:6309
- https://access.redhat.com/errata/RHSA-2024:6488
- https://access.redhat.com/errata/RHSA-2024:6612
- https://access.redhat.com/errata/RHSA-2024:6611
- https://access.redhat.com/errata/RHSA-2024:6661
- https://access.redhat.com/errata/RHSA-2024:6662
- https://access.redhat.com/errata/RHSA-2024:6726
- https://access.redhat.com/errata/RHSA-2024:6907
- https://access.redhat.com/errata/RHSA-2024:7213
- https://access.redhat.com/errata/RHSA-2024:7374
- https://access.redhat.com/errata/RHSA-2024:7922
- https://access.redhat.com/errata/RHSA-2024:8172
- https://access.redhat.com/errata/RHSA-2024:8173
- https://access.redhat.com/errata/RHSA-2024:8170
- https://access.redhat.com/errata/RHSA-2024:8171
- https://access.redhat.com/errata/RHSA-2024:8168
- https://access.redhat.com/errata/RHSA-2024:8179
- https://access.redhat.com/security/cve/CVE-2024-6345
- https://access.redhat.com/security/cve/CVE-2022-40897
- https://pypi.org/project/setuptools/
- https://pypi.org/project/setuptools/#history
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2297771#c51
- https://access.redhat.com/security/updates/advisory/
- https://bugzilla.redhat.com/show_bug.cgi?id=2297771
- agent/title
- agent/weakness
- agent/type
- collector/nvd-api
- source/NVD
- collector/nvd-cve
- agent/author
- collector/mitre-cve
- source/MITRE
- collector/github-advisory
- source/GitHub
- alias/GHSA-cx63-2mw6-8hw5
- alias/CVE-2024-6345
- agent/software-canonical-lookup
- collector/github-advisory-latest
- agent/severity
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/first-publish-date
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/usn-cve
- source/Ubuntu
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- agent/last-modified-date
- agent/references
- agent/tags
- agent/trending
- package-manager/pip
- package-manager/debian