Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2024-6345

Remote Code Execution in pypa/setuptools

A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed
Vendors
Python Redhat
Products
Setuptools Enterprise Linux Openshift and 7 more
CVE-2022-40897

pypa-setuptools: Regular Expression Denial of Service (ReDoS) in package_index.py

Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.

CVSS 3.1 · 5.9 Medium EPSS 2.6% KEV · Not listed
Vendors
Python Redhat
Products
Setuptools Enterprise Linux Rhel Aus and 4 more
CVE-2025-47273

setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue.

CVSS 4.0 · 7.7 High EPSS 1.6% KEV · Not listed
Vendors
Debian Python Redhat
Products
Debian Linux Setuptools Enterprise Linux and 1 more
CVE-2018-1113

setup: nologin listed in /etc/shells violates security expectations

setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells. This violates security assumptions made by pam_shells and some daemons which allow access based on a user's shell being listed in /etc/shells. Under some circumstances, users which had their shell changed to /sbin/nologin could still access the system.

CVSS 3.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Enterprise Linux Enterprise Linux Desktop and 3 more