VDB
PYSEC-2022-43012
PYSEC-2022-43012
PUBLISHED
CVSS 8.699999809265137 HIGH
Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
Risk Scores
CVSS v4.0
8.699999809265137
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| PyPI | setuptools | 0.6b2, 0.6b3, 0.6b4 |
Timeline
- Dec 23, 2022 CVE Published
- Dec 6, 2023 CVE Updated
References
- https://github.com/pypa/setuptools/blob/fe8a98e696241487ba6ac9f91faa38ade939ec5d/setuptools/package_index.py#L200 url
- https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/ url
- https://github.com/pypa/setuptools/compare/v65.5.0...v65.5.1 url
- https://pyup.io/vulnerabilities/CVE-2022-40897/52495/ url
- https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be fix