Bug 1228105 (CVE-2024-6345) - VUL-0: CVE-2024-6345: python-setuptools: code execution via download functions in the package_index module in pypa/setuptools
Summary: VUL-0: CVE-2024-6345: python-setuptools: code execution via download function...
Status: NEW
Alias: CVE-2024-6345
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P2 - High : Major
Target Milestone: ---
Assignee: Python maintainers (group account)
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/414074/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-6345:7.0:(AV:L...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-07-18 10:46 UTC by SMASH SMASH
Modified: 2024-07-18 11:54 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-07-18 10:46:41 UTC 
A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-6345
https://www.cve.org/CVERecord?id=CVE-2024-6345
https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0
https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
https://bugzilla.redhat.com/show_bug.cgi?id=2297771