ALINUX2-SA-2024%3A0043

ALINUX2-SA-2024%3A0043 PUBLISHED CVSS 8.800000190734863 HIGH

Record from alibaba-cloud · Published December 2, 2024

Package updates are available for Alibaba Cloud Linux 2.1903 that fix the following vulnerabilities: CVE-2024-6345: A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.

Risk scores

CVSS 3.1

8.800000190734863

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Vendor	Product	Versions
Alibaba Cloud	python3-setuptools

Timeline

Dec 2, 2024 CVE Published
Dec 2, 2024 CVE Updated

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln ALINUX2-SA-2024%3A0043
vulnetix vdb fixes ALINUX2-SA-2024%3A0043

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/ALINUX2-SA-2024%253A0043/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →