REDHAT-BUG-2366982: Path Traversal
setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in PackageIndex is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
setuptools/PackageIndexto a version that resolves this vulnerability.Fixed in 78.1.1
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2366982?
The severity of REDHAT-BUG-2366982 is classified as high due to the potential for arbitrary file write operations.
How do I fix REDHAT-BUG-2366982?
To fix REDHAT-BUG-2366982, upgrade setuptools to version 78.1.1 or later.
What systems are affected by REDHAT-BUG-2366982?
REDHAT-BUG-2366982 affects setuptools versions prior to 78.1.1.
What kind of vulnerability is REDHAT-BUG-2366982?
REDHAT-BUG-2366982 is a path traversal vulnerability that allows attackers to write files to arbitrary locations.
Can REDHAT-BUG-2366982 be exploited remotely?
Yes, REDHAT-BUG-2366982 can potentially be exploited remotely if an attacker can command the affected setuptools package.