Most recent entries from all

ALSA-2023:0835 — Moderate: python-setuptools security update

Affected: AlmaLinux:8: platform-python-setuptools, AlmaLinux:8: python3-setuptools, AlmaLinux:8: python3-setuptools-wheel

The python-setuptools package provides a collection of enhancements to Python distribution utilities allowing convenient building and distribution of Python packages.

Security Fix(es):

* pypa-setuptools: Regular Expression Denial of Service (ReDoS) in package_index.py (CVE-2022-40897)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2023-02445

Withdrawn: BELL-CVE-2022-40897 — CVE-2022-40897 does not affect BellSoft software

Withdrawn by the publisher.

BIT-setuptools-2022-40897

Affected: Bitnami: setuptools

Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.

BREW-ansible-CVE-2022-40897 — pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS)

Affected: Homebrew: ansible

Python Packaging Authority (PyPA)'s setuptools is a library designed to facilitate packaging Python projects. Setuptools version 65.5.0 and earlier could allow remote attackers to cause a denial of service by fetching malicious HTML from a PyPI package or custom PackageIndex page due to a vulnerable Regular Expression in `package_index`. This has been patched in version 65.5.1.

certfr-2023-avi-0086 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2023-avi-0086

EUVD-2026-258812

fkie_cve-2022-40897

GHSA-r9hx-vwmv-q579 — pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS)

Affected: PyPI: setuptools

gsd-2022-40897

msrc_CVE-2022-40897 — Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTM…

msrc_CVE-2022-40897

OESA-2023-1004 — python-setuptools security update

Affected: openEuler:20.03-LTS-SP1: python-setuptools, openEuler:20.03-LTS-SP3: python-setuptools, openEuler:22.03-LTS: python-setuptools, openEuler:22.03-LTS-SP1: python-setuptools

Setuptools is a collection of enhancements to the Python distutils that allow you to more easily build and distribute Python packages, especially ones that have dependencies on other packages.This package contains a python wheel of setuptools to use with venv. Security Fix(es): Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.(CVE-2022-40897)

PYSEC-2022-43012

Affected: PyPI: setuptools

RHSA-2023:0835 — Red Hat Security Advisory: python-setuptools security update

pypa-setuptools: Regular Expression Denial of Service (ReDoS) in package_index.py

RHSA-2023:6793 — Red Hat Security Advisory: rh-python38-python security update

python: tarfile module directory traversal pypa-setuptools: Regular Expression Denial of Service (ReDoS) in package_index.py python-wheel: remote attackers can cause denial of service via attacker controlled input to wheel cli python: CPU denial of service via inefficient IDNA decoder python-cryptography: memory corruption via immutable objects python: urllib.parse url blocklisting bypass python-requests: Unintended leak of Proxy-Authorization header python: TLS handshake bypass

SUSE-SU-2023:0093-1 — Security update for python-setuptools

Security update for python-setuptools

UBUNTU-CVE-2022-40897

Affected: Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:14.04:LTS: python-setuptools, Ubuntu:Pro:16.04:LTS: python-setuptools, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:18.04:LTS: python-pip, Ubuntu:18.04:LTS: python-setuptools, Ubuntu:20.04:LTS: python-pip, Ubuntu:20.04:LTS: python-setuptools, Ubuntu:20.04:LTS: setuptools, Ubuntu:22.04:LTS: python-pip and 2 more

VDE-2024-073 — Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware

Gvariant offset table entry size is not checked in is_normal() G_variant_byteswap() can take a long time with some non-normal inputs Gvariant deserialisation does not match spec for non-normal data Glibc: dos due to memory leak in getaddrinfo.c Glibc: buffer overflow in ld.so leading to privilege escalation Gnutls: incomplete fix for cve-2023-5981 Gnutls: rejects certificate chain with distributed trust Denial-of-Service in gRPC Information leak in gRPC Denial-of-Service in gRPC Denial of Service in gRPC Core Libssh: proxycommand/proxyjump features allow injection of malicious code through hostname Arbitrary Memory Disclosure through CPU Side-Channel Attacks (Retbleed) Incorrect cipher key & IV length processing POLY1305 MAC implementation corrupts XMM registers on Windows Excessive time spent checking DH q parameter value SQLite SQLite3 make alltest sqlite3session.c sessionReadRecord heap-based overflow NULL Pointer Dereference in vim/vim Heap-based Buffer Overflow in vim/vim Use After Free in vim/vim Heap-based Buffer Overflow in vim/vim Integer Overflow or Wraparound in vim/vim Use After Free in vim/vim Untrusted Search Path in vim/vim Out-of-bounds Write in vim/vim Use After Free in vim/vim Heap-based Buffer Overflow in vim/vim Use After Free in vim/vim Heap-based Buffer Overflow in vim/vim Use-After-Free in win_close() in vim overflow in shift_line in vim Vim has heap-use-after-free at /src/charset.c:1770:12 in skipwhite Integer Overflow in :history command in Vim

WID-SEC-W-2023-0255 — IBM Spectrum Protect: Mehrere Schwachstellen

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in IBM Spectrum Protect ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen und einen Denial of Service zu verursachen.