VDB
RHBA-2024:5039
RHBA-2024:5039
PUBLISHED
CVSS 6.300000190734863 MEDIUM
A flaw was found in the package_index module of pypa/setuptools. Affected versions of this package allow remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
Risk Scores
CVSS 3.1
6.300000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | quay/quay-operator-bundle@sha256:0b91cd4ec1a8344d3870eb2d7d7ee7a330f8024455e79f415f0fe533b0755994_ppc64le as a component of Quay v3 | * |
| Red Hat | quay/quay-bridge-operator-bundle@sha256:e365dff96148af07cd95571f7aef49cb57068b53bb8e59921388889b0b3b97e5_amd64 as a component of Quay v3 | * |
| Red Hat | quay/quay-container-security-operator-rhel8@sha256:dba9ef1a15d269fd3a76483581ded14b52ca01190ad0a6591da9b2e4049baa5b_amd64 as a component of Quay v3 | * |
| Red Hat | quay/quay-operator-rhel8@sha256:919422f820a70dca69a1918ea1f5540f04e524f1ba3620a04393f67ae3922369_s390x as a component of Quay v3 | * |
| Red Hat | quay/quay-builder-qemu-rhcos-rhel8@sha256:c313b557b75742723228e84b1f25f1fe8bb234fa0b60abec5448ea0527e04076_ppc64le as a component of Quay v3 | * |
| Red Hat | quay/quay-builder-rhel8@sha256:53e16de2dcff319c47d54bcbfb4612f4b6e071ca7e513a0571950ddbf4ce46a3_s390x as a component of Quay v3 | * |
| Red Hat | quay/quay-operator-bundle@sha256:b159f3721ce70c1fa11fa827cd3efa217e43d2ca57ac44838d3f445840461aef_s390x as a component of Quay v3 | * |
| Red Hat | quay/clair-rhel8@sha256:c512daee0b7f2fafe4d1124ecdd9fc6bb7a04619a77ebb3d64b2e0fcb51062e1_ppc64le as a component of Quay v3 | * |
| Red Hat | quay/quay-bridge-operator-bundle@sha256:53e3ef86d08fb4947c945ceca7392b3e757cd988211d54cfc4d4b5372befef1b_ppc64le as a component of Quay v3 | * |
| Red Hat | quay/quay-container-security-operator-bundle@sha256:cf7ca3537545ad9f71adf2d58e9037d947b5c307fb0a3aaf7196b05c00a8004b_ppc64le as a component of Quay v3 | * |
| Red Hat | quay/quay-builder-qemu-rhcos-rhel8@sha256:ae2b191f53bb9d87a66e609bd71cf7b264e3448d6097871bc590773b4c3ca557_s390x as a component of Quay v3 | * |
| Red Hat | quay/clair-rhel8@sha256:577458b6392e6519d032b389935665d7d198d3561db24074910f256c1fe4e3f1_amd64 as a component of Quay v3 | * |
| Red Hat | quay/quay-rhel8@sha256:1bb2235e8cc42e18d9406c509272ba668b9761bd1a62bd87827c75dc07d6d217_amd64 as a component of Quay v3 | * |
| Red Hat | quay/clair-rhel8@sha256:85afe4b0a4aa4d6d5b185fdfcf0b4ac3c999fa5318be5738239be16990897fe4_s390x as a component of Quay v3 | * |
| Red Hat | quay/quay-rhel8@sha256:eaea91ebc5e9cdc7beb45b88065b339c431eb8d736046c33df9429017c900fee_ppc64le as a component of Quay v3 | * |
| Red Hat | quay/quay-bridge-operator-rhel8@sha256:05ca3d6fd58aac396387197cc1794fe6a1500a5429964c56b23f5ef536b6ffad_amd64 as a component of Quay v3 | * |
| Red Hat | quay/quay-operator-rhel8@sha256:f577d16f91f542b6c1613e11c602a85e9ed5a7e21e59264e7fbadef4627721f0_ppc64le as a component of Quay v3 | * |
| Red Hat | quay/quay-operator-bundle@sha256:9607e4d2493623608d8c7b578ff65cbece8e0b7f609b82f22858f9e313f4face_amd64 as a component of Quay v3 | * |
| Red Hat | quay/quay-container-security-operator-rhel8@sha256:56fb1b958bdaa12f4b4dd4940f4fa75a44516e3e34cda47c3f03657c12afae03_ppc64le as a component of Quay v3 | * |
| Red Hat | quay/quay-container-security-operator-bundle@sha256:39452abef3641134972d119b67e30738efb89e96c30e6c8f98bce66ede4be03b_amd64 as a component of Quay v3 | * |
…and 10 more
Timeline
- Aug 19, 2024 CVE Published
- Oct 16, 2026 CVE Updated
- Oct 16, 2026 Security Advisory
- Oct 16, 2026 Security Advisory
- Oct 16, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHBA-2024:5039 advisory
- https://issues.redhat.com/browse/PROJQUAY-7177 advisory
- https://issues.redhat.com/browse/PROJQUAY-7425 advisory
- https://issues.redhat.com/browse/PROJQUAY-7446 advisory
- https://issues.redhat.com/browse/PROJQUAY-7449 advisory
- https://issues.redhat.com/browse/PROJQUAY-7467 advisory
- https://issues.redhat.com/browse/PROJQUAY-7487 advisory
- https://issues.redhat.com/browse/PROJQUAY-7491 advisory
- https://issues.redhat.com/browse/PROJQUAY-7523 advisory
- https://issues.redhat.com/browse/PROJQUAY-7578 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhba-2024_5039.json advisory
- https://access.redhat.com/security/cve/CVE-2024-6345 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2297771 issue
- https://www.cve.org/CVERecord?id=CVE-2024-6345 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-6345 advisory
- https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0 advisory
- https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5 advisory
- https://access.redhat.com/security/cve/CVE-2024-36039 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2282821 issue
- https://www.cve.org/CVERecord?id=CVE-2024-36039 advisory
…and 1 more