A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.
CVSS Details
- CVSS 3.0 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python39-develUpgrade fence-virtd-cpgUpgrade python39-pyyamlUpgrade fence-agents-ilo2Upgrade fence-agents-drac5Upgrade fence-agents-amt-wsUpgrade fence-agents-intelmodularUpgrade fence-agents-gceUpgrade python39-pysocksUpgrade python39-PyMySQLUpgrade python39-psycopg2-testsUpgrade fence-agents-kdumpUpgrade python39-debugUpgrade python39-numpy-f2pyUpgrade fence-agents-ipmilanUpgrade python39-pybind11Upgrade fence-agents-ibm-powervsUpgrade fence-agents-sbdUpgrade python39-libsUpgrade python39-cffiUpgrade python39-packagingUpgrade fence-virtdUpgrade fence-agents-ilo-mpUpgrade python39-numpy-docUpgrade python39-tkinterUpgrade fence-agents-aliyunUpgrade fence-agents-ibmbladeUpgrade python39-testUpgrade python39-idleUpgrade fence-virtd-tcpUpgrade fence-agents-kubevirtUpgrade python39-more-itertoolsUpgrade fence-agents-bladecenterUpgrade fence-agents-vmware-soapUpgrade fence-agents-heuristics-pingUpgrade fence-agents-virshUpgrade fence-agents-allUpgrade python39-pyUpgrade python39-setuptoolsUpgrade python39-wheel-wheelUpgrade python39-rpm-macrosUpgrade python39-iniconfigUpgrade python39-pytestUpgrade python39-tomlUpgrade fence-agents-computeUpgrade python39-requestsUpgrade python39-plyUpgrade ha-cloud-supportUpgrade python39-pluggyUpgrade python3.12-setuptoolsUpgrade python39-lxmlUpgrade python39-pyparsingUpgrade fence-agents-rsaUpgrade fence-agents-mpathUpgrade python3-setuptools-wheelUpgrade python39-attrsUpgrade fence-agents-azure-armUpgrade platform-python-setuptoolsUpgrade python39-wheelUpgrade python39-pybind11-develUpgrade fence-agents-rsbUpgrade fence-agents-emersonUpgrade fence-agents-redfishUpgrade fence-agents-cisco-mdsUpgrade fence-agents-scsiUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-epsUpgrade python39-CythonUpgrade python39-pip-wheelUpgrade fence-agents-apc-snmpUpgrade fence-virtd-multicastUpgrade fence-agents-ilo-sshUpgrade python3-setuptoolsUpgrade fence-agents-wtiUpgrade fence-agents-brocadeUpgrade python39-urllib3Upgrade fence-agents-vmware-restUpgrade python39-idnaUpgrade python39-wcwidthUpgrade fence-virtUpgrade python39-psutilUpgrade fence-agents-rhevmUpgrade python39-pycparserUpgrade resource-agents-pafUpgrade python3.12-setuptools-wheelUpgrade python39-pipUpgrade python39-psycopg2Upgrade python39-mod_wsgiUpgrade fence-agents-hpbladeUpgrade resource-agents-gcpUpgrade resource-agents-aliyunUpgrade fence-agents-zvmUpgrade fence-agents-ibm-vpcUpgrade python39-chardetUpgrade python39-scipyUpgrade python39-psycopg2-docUpgrade python39-setuptools-wheelUpgrade fence-agents-commonUpgrade resource-agentsUpgrade fence-agents-ifmibUpgrade fence-agents-lparUpgrade fence-virtd-libvirtUpgrade fence-virtd-serialUpgrade fence-agents-awsUpgrade fence-agents-ipduUpgrade fence-agents-apcUpgrade python39Upgrade python39-cryptographyUpgrade fence-agents-cisco-ucsUpgrade python39-numpyUpgrade python39-sixUpgrade python3.11-setuptools-wheelUpgrade fence-agents-eaton-snmpUpgrade fence-agents-openstackUpgrade python3.11-setuptools | Aug 22, 2024 | Jul 15, 2024 |
| Alpine Linux | — | Upgrade py3-setuptools | Aug 22, 2024 | Jul 15, 2024 |
| Amazon Linux Ami 2 | — | Upgrade python2-setuptoolsUpgrade python3-setuptoolsUpgrade python-setuptools-wheelUpgrade python38-setuptools | Sep 19, 2024 | Jul 15, 2024 |
| Debian | — | Upgrade setuptools | Sep 6, 2024 | Jul 15, 2024 |
| Dell Powerstore Dsa2024462 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Nov 20, 2024 |
| Dell Powerstore Dsa2024497 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Dec 19, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python-setuptoolsUpgrade python3-setuptools | Nov 11, 2024 | Jul 15, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade python-setuptoolsUpgrade python3-setuptools | Oct 9, 2024 | Jul 15, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python-setuptools | Nov 5, 2024 | Jul 15, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-setuptoolsUpgrade python-setuptools | Nov 11, 2024 | Jul 15, 2024 |
| Ibm Aix | — | Apply the fix or workaround for python_advisory11 | Aug 13, 2024 | Jul 15, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Feb 17, 2025 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 37087534 for version 14.1.1.0.0. | Oct 18, 2024 | Jul 15, 2024 |
| Oracle_linux | — | Upgrade fence-agents-commonUpgrade fence-agents-bladecenterUpgrade python39-testUpgrade python39-debugUpgrade python-setuptoolsUpgrade fence-agents-ibm-vpcUpgrade fence-agents-ibm-powervsUpgrade python3-setuptoolsUpgrade fence-agents-apc-snmpUpgrade platform-python-setuptoolsUpgrade fence-agents-computeUpgrade python39-sixUpgrade python39-pycparserUpgrade python39-numpy-f2pyUpgrade fence-agents-cisco-mdsUpgrade fence-virtd-tcpUpgrade fence-agents-kdumpUpgrade fence-agents-allUpgrade fence-agents-ilo-moonshotUpgrade python39-psycopg2-testsUpgrade python39-pyyamlUpgrade python39-numpy-docUpgrade python39-numpyUpgrade fence-virtdUpgrade fence-agents-ilo-sshUpgrade fence-agents-ipduUpgrade python39-libsUpgrade python39-idleUpgrade fence-virtd-cpgUpgrade fence-agents-ilo-mpUpgrade fence-agents-brocadeUpgrade resource-agentsUpgrade python39-scipyUpgrade python39-tkinterUpgrade fence-agents-rsbUpgrade fence-agents-epsUpgrade fence-agents-vmware-soapUpgrade python39-PyMySQLUpgrade python39-psycopg2-docUpgrade fence-agents-sbdUpgrade fence-agents-emersonUpgrade fence-agents-cisco-ucsUpgrade fence-agents-virshUpgrade fence-virtUpgrade fence-agents-rhevmUpgrade fence-agents-eaton-snmpUpgrade fence-agents-amt-wsUpgrade python39-develUpgrade python3.12-setuptools-wheelUpgrade python39-idnaUpgrade python39-lxmlUpgrade python39-rpm-macrosUpgrade fence-agents-mpathUpgrade fence-agents-lparUpgrade fence-virtd-libvirtUpgrade python3.12-setuptoolsUpgrade fence-agents-wtiUpgrade python39-pip-wheelUpgrade python39-tomlUpgrade fence-agents-kubevirtUpgrade python39-psutilUpgrade python39-psycopg2Upgrade fence-agents-scsiUpgrade python39-setuptoolsUpgrade python39-pysocksUpgrade python39-plyUpgrade fence-agents-intelmodularUpgrade fence-agents-heuristics-pingUpgrade fence-agents-ibmbladeUpgrade fence-agents-rsaUpgrade fence-agents-ipmilanUpgrade fence-agents-ilo2Upgrade fence-agents-redfishUpgrade fence-virtd-multicastUpgrade python39-cryptographyUpgrade python39-requestsUpgrade python39Upgrade fence-agents-apcUpgrade fence-agents-hpbladeUpgrade fence-agents-ifmibUpgrade python3.11-setuptoolsUpgrade python39-wheelUpgrade fence-agents-drac5Upgrade fence-agents-vmware-restUpgrade python3-setuptools-wheelUpgrade python39-pipUpgrade python39-mod_wsgiUpgrade python3.11-setuptools-wheelUpgrade python39-chardetUpgrade python39-urllib3Upgrade python39-cffiUpgrade python39-setuptools-wheelUpgrade fence-virtd-serialUpgrade python39-wheel-wheel | Oct 16, 2024 | Jul 15, 2024 |
| Redhat Openshift | — | Upgrade rhcos | Oct 17, 2024 | Jul 15, 2024 |
| Redhat_linux | — | Upgrade python39-mod_wsgiUpgrade python39-psutilUpgrade python39-pybind11Upgrade PyYAML-debugsourceUpgrade python-setuptoolsUpgrade scipy-debugsourceUpgrade python39-pybind11-develUpgrade python-psycopg2-debugsourceUpgrade python39-pipUpgrade fence-agents-computeUpgrade fence-agents-ibmbladeUpgrade fence-virtdUpgrade python39-cryptographyUpgrade python39-wheel-wheelUpgrade fence-agents-allUpgrade python39-develUpgrade python39-plyUpgrade python39-requestsUpgrade fence-agents-debugsourceUpgrade fence-agents-virshUpgrade fence-virtd-debuginfoUpgrade fence-agents-kubevirtUpgrade python3.11-setuptools-wheelUpgrade fence-agents-awsUpgrade python39-chardetUpgrade python39-tomlUpgrade fence-agents-ilo-mpUpgrade fence-virtd-tcpUpgrade resource-agents-debugsourceUpgrade python-cffi-debugsourceUpgrade fence-agents-wtiUpgrade fence-agents-azure-armUpgrade fence-agents-debuginfoUpgrade fence-agents-gceUpgrade fence-agents-intelmodularUpgrade fence-agents-openstackUpgrade fence-agents-ipduUpgrade fence-agents-ibm-powervsUpgrade python39-sixUpgrade python39-cryptography-debuginfoUpgrade python39-setuptoolsUpgrade ha-cloud-supportUpgrade python39-debugUpgrade python39-idnaUpgrade fence-agents-scsiUpgrade fence-virtd-libvirtUpgrade python39-urllib3Upgrade fence-agents-ipmilanUpgrade python39-rpm-macrosUpgrade fence-virt-debuginfoUpgrade fence-agents-lparUpgrade python39-Cython-debuginfoUpgrade python39-tkinterUpgrade python39-psycopg2-debuginfoUpgrade fence-agents-aliyun-debuginfoUpgrade python39-more-itertoolsUpgrade fence-agents-aliyunUpgrade fence-agents-ilo-sshUpgrade Cython-debugsourceUpgrade fence-agents-kdump-debuginfoUpgrade python39-iniconfigUpgrade python39-pyUpgrade fence-agents-vmware-soapUpgrade python39-pyparsingUpgrade python39-pytestUpgrade python39-wheelUpgrade resource-agents-aliyun-debuginfoUpgrade python3-setuptools-wheelUpgrade python39-setuptools-wheelUpgrade python39-pysocksUpgrade resource-agents-debuginfoUpgrade fence-virtd-serialUpgrade fence-virtd-tcp-debuginfoUpgrade fence-agents-redfishUpgrade python39-debuginfoUpgrade python39-pluggyUpgrade fence-virtUpgrade ha-cloud-support-debuginfoUpgrade python39-psycopg2-testsUpgrade python39-cffi-debuginfoUpgrade fence-agents-heuristics-pingUpgrade python39Upgrade fence-agents-brocadeUpgrade python-cryptography-debugsourceUpgrade python39-libsUpgrade fence-agents-mpathUpgrade python39-psutil-debuginfoUpgrade python39-cffiUpgrade resource-agentsUpgrade python39-debugsourceUpgrade python39-testUpgrade python3.11-setuptoolsUpgrade python3.12-setuptoolsUpgrade fence-agents-cisco-mdsUpgrade python39-packagingUpgrade python39-PyMySQLUpgrade fence-virtd-multicastUpgrade python39-psycopg2-docUpgrade fence-agents-kdumpUpgrade python39-wcwidthUpgrade fence-agents-rsbUpgrade python39-scipyUpgrade fence-agents-commonUpgrade fence-agents-drac5Upgrade fence-agents-apc-snmpUpgrade fence-agents-apcUpgrade fence-virtd-multicast-debuginfoNo solution existsUpgrade fence-virtd-cpgUpgrade fence-agents-rsaUpgrade platform-python-setuptoolsUpgrade python39-numpyUpgrade resource-agents-pafUpgrade python39-scipy-debuginfoUpgrade python-lxml-debugsourceUpgrade python39-pycparserUpgrade python39-lxmlUpgrade python39-numpy-docUpgrade python39-attrsUpgrade fence-agents-sbdUpgrade fence-agents-ifmibUpgrade fence-agents-emersonUpgrade python39-CythonUpgrade fence-agents-hpbladeUpgrade python39-numpy-f2pyUpgrade fence-virtd-libvirt-debuginfoUpgrade fence-agents-zvmUpgrade fence-agents-ilo-moonshotUpgrade python39-numpy-debuginfoUpgrade resource-agents-aliyunUpgrade fence-agents-vmware-restUpgrade python39-pyyaml-debuginfoUpgrade python39-psycopg2Upgrade fence-agents-ibm-vpcUpgrade fence-agents-amt-wsUpgrade python39-lxml-debuginfoUpgrade fence-agents-bladecenterUpgrade numpy-debugsourceUpgrade python39-pip-wheelUpgrade resource-agents-gcpUpgrade python39-idleUpgrade fence-agents-kubevirt-debuginfoUpgrade python3.12-setuptools-wheelUpgrade fence-agents-cisco-ucsUpgrade python3-setuptoolsUpgrade python-psutil-debugsourceUpgrade fence-virtd-serial-debuginfoUpgrade fence-agents-ilo2Upgrade fence-agents-rhevmUpgrade fence-agents-epsUpgrade fence-agents-eaton-snmpUpgrade fence-virtd-cpg-debuginfoUpgrade python39-pyyaml | Aug 7, 2024 | Jul 15, 2024 |
| Rocky_linux | — | Upgrade fence-virtd-serialUpgrade python39-scipy-debuginfoUpgrade fence-agents-azure-armUpgrade fence-virtd-libvirtUpgrade python39-cffiUpgrade resource-agents-debugsourceUpgrade python39-psutil-debuginfoUpgrade python39-pyyaml-debuginfoUpgrade python39-psycopg2-debuginfoUpgrade python39-psycopg2-docUpgrade fence-agents-debuginfoUpgrade resource-agents-pafUpgrade fence-agents-zvmUpgrade fence-agents-allUpgrade PyYAML-debugsourceUpgrade fence-agents-kdump-debuginfoUpgrade python39-tkinterUpgrade python39-debuginfoUpgrade python39-testUpgrade numpy-debugsourceUpgrade fence-agents-redfishUpgrade python39-mod_wsgiUpgrade resource-agents-gcpUpgrade python-cffi-debugsourceUpgrade fence-virt-debuginfoUpgrade resource-agents-aliyun-debuginfoUpgrade python39-numpy-debuginfoUpgrade python39-debugUpgrade python39-psutilUpgrade fence-virtd-serial-debuginfoUpgrade python39-psycopg2Upgrade fence-agents-aliyunUpgrade ha-cloud-supportUpgrade python-psutil-debugsourceUpgrade python39-scipyUpgrade python39-Cython-debuginfoUpgrade resource-agents-debuginfoUpgrade python39-lxml-debuginfoUpgrade fence-agents-kubevirtUpgrade fence-agents-awsUpgrade fence-virtd-libvirt-debuginfoUpgrade fence-agents-gceUpgrade fence-virtd-cpgUpgrade python39-debugsourceUpgrade python39-cryptographyUpgrade python39-numpyUpgrade python39-numpy-f2pyUpgrade ha-cloud-support-debuginfoUpgrade python-cryptography-debugsourceUpgrade fence-agents-kubevirt-debuginfoUpgrade fence-virtd-multicast-debuginfoUpgrade python39-idleUpgrade python39-CythonUpgrade fence-agents-kdumpUpgrade scipy-debugsourceUpgrade python39-develUpgrade python39-cryptography-debuginfoUpgrade python39Upgrade fence-virtd-tcp-debuginfoUpgrade fence-virtd-tcpUpgrade fence-virtUpgrade fence-agents-debugsourceUpgrade python39-pybind11Upgrade resource-agents-aliyunUpgrade python39-libsUpgrade fence-virtd-debuginfoUpgrade fence-virtdUpgrade fence-agents-aliyun-debuginfoUpgrade python39-cffi-debuginfoUpgrade fence-virtd-cpg-debuginfoUpgrade Cython-debugsourceUpgrade python39-psycopg2-testsUpgrade python39-pybind11-develUpgrade fence-virtd-multicastUpgrade python39-pyyamlUpgrade resource-agentsUpgrade python-lxml-debugsourceUpgrade fence-agents-openstackUpgrade fence-agents-computeUpgrade python39-lxmlUpgrade python-psycopg2-debugsource | Oct 2, 2024 | Jul 15, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.3.5Upgrade Splunk Enterprise to version 9.4.3Upgrade Splunk Enterprise to version 9.1.10Upgrade Splunk Enterprise to version 9.2.7 | Sep 30, 2025 | Jul 15, 2024 |
| Suse | — | Upgrade python39-setuptoolsUpgrade python36-setuptoolsUpgrade python312-setuptoolsUpgrade python313-setuptoolsUpgrade python-setuptoolsUpgrade python3-setuptoolsUpgrade python311-setuptools-wheelUpgrade python3-setuptools-testUpgrade python313-setuptools-wheelUpgrade python2-setuptoolsUpgrade python311-setuptoolsUpgrade python310-setuptoolsUpgrade python3-setuptools-wheel | Aug 15, 2024 | Jul 15, 2024 |
| Ubuntu | — | Upgrade python3-setuptools (Ubuntu Pro)Upgrade python3-setuptoolsUpgrade pypy-setuptools (Ubuntu Pro)Upgrade python-setuptools (Ubuntu Pro) | Sep 13, 2024 | Jul 15, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 15, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub