python3-setuptools-39.2.0-10.0.5.0.1.el7.AXS7
エラータID: AXSA:2025-11012:02
リリース日:
2025/11/04 Tuesday - 12:11
題名:
python3-setuptools-39.2.0-10.0.5.0.1.el7.AXS7
影響のあるチャネル:
Asianux Server 7 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Python Packaging Authority (PyPA) setuptools には、リモートの
攻撃者により、細工されたパッケージもしくは改変した PackageIndex
ページの HTML を介して、正規表現のサービス拒否攻撃を可能とする
脆弱性が存在します。(CVE-2022-40897)
- pypa/setuptools の package_index モジュールには、リモートの
攻撃者により、利用者もしくはパッケージインデックスサーバーから
取得した細工された URL の処理を介して、任意のコマンドの実行を
可能とする脆弱性が存在します。(CVE-2024-6345)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2022-40897
Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
CVE-2024-6345
A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.
A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.
追加情報:
N/A
ダウンロード:
Asianux Server 7 for x86_64
- python3-setuptools-39.2.0-10.0.5.0.1.el7.AXS7.noarch.rpm
MD5: eeae69baa76ec477098615e542c7022b
SHA-256: 3ad4e53ded2c6d8ddd5f68e887dcbb165de7b8b0ba9819a691128ea4f07f1b4b
Size: 628.97 kB
English