CVE-2024-6345

2024-07-1500:00:00

ubuntu.com

vulnerability

pypa/setuptools

remote code execution

download functions

version 70.0

code injection

package urls

system commands

python-pip package

patching

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

Low

JSON

A vulnerability in the package_index module of pypa/setuptools versions up
to 69.1.1 allows for remote code execution via its download functions.
These functions, which are used to download packages from URLs provided by
users or retrieved from package index servers, are susceptible to code
injection. If these functions are exposed to user-controlled inputs, such
as package URLs, they can execute arbitrary commands on the system. The
issue is fixed in version 70.0.

Notes

Author	Note
mdeslaur	On focal and earlier, the python-pip package bundles python-setuptools binaries when built. After updating python-setuptools, a no-change rebuild of python-pip is required. On jammy and later, python-setuptools is bundled in the python-pip package and needs to be patched.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchpython-pip< anyUNKNOWN
ubuntu20.04noarchpython-pip< anyUNKNOWN
ubuntu22.04noarchpython-pip< anyUNKNOWN
ubuntu24.04noarchpython-pip< anyUNKNOWN
ubuntu14.04noarchpython-pip< anyUNKNOWN
ubuntu16.04noarchpython-pip< anyUNKNOWN
ubuntu18.04noarchpython-setuptools< anyUNKNOWN
ubuntu20.04noarchpython-setuptools< anyUNKNOWN
ubuntu22.04noarchpython-setuptools< anyUNKNOWN
ubuntu14.04noarchpython-setuptools< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	python-pip	< any	UNKNOWN
ubuntu	20.04	noarch	python-pip	< any	UNKNOWN
ubuntu	22.04	noarch	python-pip	< any	UNKNOWN
ubuntu	24.04	noarch	python-pip	< any	UNKNOWN
ubuntu	14.04	noarch	python-pip	< any	UNKNOWN
ubuntu	16.04	noarch	python-pip	< any	UNKNOWN
ubuntu	18.04	noarch	python-setuptools	< any	UNKNOWN
ubuntu	20.04	noarch	python-setuptools	< any	UNKNOWN
ubuntu	22.04	noarch	python-setuptools	< any	UNKNOWN
ubuntu	14.04	noarch	python-setuptools	< any	UNKNOWN