CVE-2024-25081_2025-47273

CVE-2024-25081 および CVE-2025-47273 の概念実証 FontForge ≤ 20230101 バージョンおよび Setuptools ライブラリ FontForge を使用するタスクを実行中のユーザーへの特権昇格の概念実証です。2番目のCVEは、機密ディレクトリへの書き込み権限がある場合にrootへの特権昇格を引き起こします。 詳細情報: CVE ID| 脆弱性| 影響 ---|---|--- CVE-2024-25081| シェルに渡す前にファイル名をサニタイズしない| 所有者ユーザーとしてのコマンドインジェクション CVE-2025-47273|...

CVE-2025-47273-PoC

CVE-2025-47273: setuptools 버전 78.1.0 - setuptools.packageindex의 경로 탐색 취약점 면책 조항 이 개념 증명PoC은 교육 목적과 공인된 보안 감사만을 위해 작성되었습니다. 작성자는 이 정보의 오용에 대해 책임을 지지 않습니다. 컴퓨터 시스템에 대한 무단 접근은 불법이며 비윤리적입니다. 취약점 분석 CVE-2025-47273은 setuptools 라이브러리v78.1.0 및 이전 버전의 packageindex 모듈에서 발견된 경로 탐색 취약점입니다. 이 취약점으로 인해 공격자는 특수...

Rocky Linux 8.6 [CIQ] Security Update: platform-python-setuptools / python2-setuptools / etc (ciqsa-2026_0922)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260922 advisory. This advisory aggregates security fixes for the python-setuptools SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2022-40897. Tenable has extracted the preceding...

Rocky Linux 9 [CIQ] Security Update: python3.12-setuptools / python3.12-setuptools-wheel (crlsa-2024_5533)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20245533 advisory. pypa/setuptools: Remote code execution via download functions in the packageindex module in pypa/setuptools CVE-2024-6345 Tenable has extracted the preceding...

Rocky Linux 9.2 [CIQ] Security Update: python3.11-setuptools / python3.11-setuptools-wheel (ciqsa-2026_0483)

The Rocky Linux 9.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260483 advisory. This advisory aggregates security fixes for the python3.11-setuptools SRPM in CIQ LTS 9.2. It addresses 1 CVE: CVE-2024-6345. Tenable has extracted the preceding...

Rocky Linux 8.6 [CIQ] Security Update: python38-setuptools / python38-setuptools-wheel Multiple Vulnerabilities (ciqsa-2026_0221)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260221 advisory. This advisory aggregates security fixes for the python3x-setuptools SRPM in CIQ LTS 8.6. It addresses 4 CVEs: CVE-2015-20107, CVE-2020-10735,...

Rocky Linux 8 [CIQ] Security Update: python3.11-setuptools / python3.11-setuptools-wheel (crlsa-2025_11043)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202511043 advisory. setuptools: Path Traversal Vulnerability in setuptools PackageIndex CVE-2025-47273 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 8 [CIQ] Security Update: platform-python-setuptools / python3-setuptools / etc (crlsa-2025_11036)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202511036 advisory. setuptools: Path Traversal Vulnerability in setuptools PackageIndex CVE-2025-47273 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 9 [CIQ] Security Update: fence-agents-aliyun / fence-agents-all / fence-agents-amt-ws / etc (crlsa-2024_6726)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20246726 advisory. pypa/setuptools: Remote code execution via download functions in the packageindex module in pypa/setuptools CVE-2024-6345 Tenable has extracted the preceding...

AlmaLinux 9.2 [TuxCare] Security Update: python3-setuptools / python3-setuptools-wheel (ALMALINUX9.2:CLSA-2026:1786468462)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786468462 advisory. - setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList...

Rocky Linux 10.0 [CIQ] Security Update: python3-setuptools / python3-setuptools-wheel (crlsa-2025_9940)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259940 advisory. setuptools: Path Traversal Vulnerability in setuptools PackageIndex CVE-2025-47273 Tenable has extracted the preceding description block directly from the CIQ...

CentOS Linux 7.9 [CIQ] Security Update: python3-setuptools Multiple Vulnerabilities (ciqsa-2026_0731)

The CentOS Linux 7.9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260731 advisory. This advisory aggregates security fixes for the python3-setuptools SRPM in CIQ CentOS Bridge 7.9. It addresses 2 CVEs: CVE-2024-6345, CVE-2022-40897...

Rocky Linux 9 [CIQ] Security Update: python3.11-setuptools / python3.11-setuptools-wheel (crlsa-2025_13578)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202513578 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and...

Rocky Linux 8 [CIQ] Security Update: platform-python-setuptools / python3-setuptools / etc (crlsa-2024_5530)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20245530 advisory. pypa/setuptools: Remote code execution via download functions in the packageindex module in pypa/setuptools CVE-2024-6345 Tenable has extracted the preceding...

Rocky Linux 8 [CIQ] Security Update: Cython-debugsource / PyYAML-debugsource / numpy-debugsource / etc Multiple Vulnerabilities (crlsa-2024_2985)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20242985 advisory. pypa-setuptools: Regular Expression Denial of Service ReDoS in packageindex.py CVE-2022-40897 python-cryptography: memory corruption via immutable objects...

Rocky Linux 8 [CIQ] Security Update: Cython-debugsource / PyYAML-debugsource / numpy-debugsource / etc Multiple Vulnerabilities (crlsa-2025_14900)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202514900 advisory. setuptools: Path Traversal Vulnerability in setuptools PackageIndex CVE-2025-47273 cpython: Cpython infinite loop when parsing a tarfile CVE-2025-8194...

Rocky Linux 9 [CIQ] Security Update: fence-agents-aliyun / fence-agents-all / fence-agents-amt-ws / etc (crlsa-2025_11463)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202511463 advisory. setuptools: Path Traversal Vulnerability in setuptools PackageIndex CVE-2025-47273 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 8.6 [CIQ] Security Update: platform-python-setuptools / python2-setuptools / etc (ciqsa-2026_0145)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260145 advisory. This advisory aggregates security fixes for the python-setuptools SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2025-47273. Tenable has extracted the preceding...

Rocky Linux 8.6 [CIQ] Security Update: platform-python-setuptools / python2-setuptools / etc (ciqsa-2026_1134)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261134 advisory. This advisory aggregates security fixes for the python-setuptools SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2024-6345. Tenable has extracted the preceding...

Rocky Linux 9 [CIQ] Security Update: python3.12-setuptools / python3.12-setuptools-wheel (crlsa-2025_12834)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202512834 advisory. setuptools: Path Traversal Vulnerability in setuptools PackageIndex CVE-2025-47273 Tenable has extracted the preceding description block directly from the CIQ...