Bug 1228105 (CVE-2024-6345)

Summary: VUL-0: CVE-2024-6345: python-setuptools: code execution via download functions in the package_index module in pypa/setuptools
Product: [Novell Products] SUSE Security Incidents Reporter: SMASH SMASH <smash_bz>
Component: IncidentsAssignee: Python maintainers (group account) <python-maintainers>
Status: NEW --- QA Contact: Security Team bot <security-team>
Severity: Major    
Priority: P2 - High CC: andrea.mattiazzo
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/414074/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-6345:7.0:(AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description SMASH SMASH 2024-07-18 10:46:41 UTC 
A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-6345
https://www.cve.org/CVERecord?id=CVE-2024-6345
https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0
https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
https://bugzilla.redhat.com/show_bug.cgi?id=2297771