PYSEC-2022-43012
At a glance
- Published
- Updated
- CVE
- CVE-2022-40897
- Aliases
- BIT-setuptools-2022-40897, GHSA-r9hx-vwmv-q579
Description
Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
Affected packages
| Package | Versions |
|---|---|
| PyPI · setuptools | introduced 0, fixed 43a9c9bfa6aa626ec2a22540bea28d2ca77964be ; introduced 0, fixed 65.5.1 |
References
- https://github.com/pypa/setuptools/blob/fe8a98e696241487ba6ac9f91faa38ade939ec5d/setuptools/package_index.py#L200 WEB
- https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/ WEB
- https://github.com/pypa/setuptools/compare/v65.5.0...v65.5.1 WEB
- https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be FIX
- https://pyup.io/vulnerabilities/CVE-2022-40897/52495/ WEB
- https://github.com/advisories/GHSA-r9hx-vwmv-q579 ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |