https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 21:36:00 +0000 https://cve.radiocsirt.org/vuln/alsa-2024:5279 <p><strong>Affected:</strong> AlmaLinux:9: python3.11-setuptools, AlmaLinux:9: python3.11-setuptools-wheel</p> <p>Setuptools is a collection of enhancements to the Python 3 distutils that allow you to more easily build and distribute Python 3 packages, especially ones that have dependencies on other packages. This package also contains the runtime components of setuptools, necessary to execute the software that requires pkg_resources.</p> <p>Security Fix(es):</p> <p>* pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools (CVE-2024-6345)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:9: python3.11-setuptools, AlmaLinux:9: python3.11-setuptools-wheel</p> <p>Setuptools is a collection of enhancements to the Python 3 distutils that allow you to more easily build and distribute Python 3 packages, especially ones that have dependencies on other packages. This package also contains the runtime components of setuptools, necessary to execute the software that requires pkg_resources.</p> <p>Security Fix(es):</p> <p>* pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools (CVE-2024-6345)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2024:5279 https://cve.radiocsirt.org/vuln/bdu:2024-05843 bdu:2024-05843 https://cve.radiocsirt.org/vuln/bdu:2024-05843 https://cve.radiocsirt.org/vuln/bell-cve-2024-6345 <p><strong>Affected:</strong> Alpaquita:23: py3-setuptools, Alpaquita:stream: py3-setuptools, BellSoft Hardened Containers:23: py3-setuptools, BellSoft Hardened Containers:stream: py3-setuptools</p> <p><strong>Affected:</strong> Alpaquita:23: py3-setuptools, Alpaquita:stream: py3-setuptools, BellSoft Hardened Containers:23: py3-setuptools, BellSoft Hardened Containers:stream: py3-setuptools</p> https://cve.radiocsirt.org/vuln/bell-cve-2024-6345 https://cve.radiocsirt.org/vuln/bit-setuptools-2024-6345 <p><strong>Affected:</strong> Bitnami: setuptools</p> <p>A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.</p> <p><strong>Affected:</strong> Bitnami: setuptools</p> <p>A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.</p> https://cve.radiocsirt.org/vuln/bit-setuptools-2024-6345 https://cve.radiocsirt.org/vuln/brew-ansible-cve-2024-6345 <p><strong>Affected:</strong> Homebrew: ansible</p> <p>A vulnerability in the `package_index` module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.</p> <p><strong>Affected:</strong> Homebrew: ansible</p> <p>A vulnerability in the `package_index` module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.</p> https://cve.radiocsirt.org/vuln/brew-ansible-cve-2024-6345 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0670 certfr-2024-avi-0670 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0670 https://cve.radiocsirt.org/vuln/cleanstart-2026-eq71754 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: python3</p> <p>Multiple security vulnerabilities affect the python3 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: python3</p> <p>Multiple security vulnerabilities affect the python3 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-eq71754 https://cve.radiocsirt.org/vuln/euvd-2026-258928 EUVD-2026-258928 https://cve.radiocsirt.org/vuln/euvd-2026-258928 https://cve.radiocsirt.org/vuln/fkie_cve-2024-6345 <p>A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.</p> <p>A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-6345 https://cve.radiocsirt.org/vuln/ghsa-cx63-2mw6-8hw5 <p><strong>Affected:</strong> PyPI: setuptools</p> <p>A vulnerability in the `package_index` module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.</p> <p><strong>Affected:</strong> PyPI: setuptools</p> <p>A vulnerability in the `package_index` module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.</p> https://cve.radiocsirt.org/vuln/ghsa-cx63-2mw6-8hw5 https://cve.radiocsirt.org/vuln/msrc_cve-2024-6345 msrc_CVE-2024-6345 https://cve.radiocsirt.org/vuln/msrc_cve-2024-6345 https://cve.radiocsirt.org/vuln/oesa-2024-1931 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: python-setuptools, openEuler:22.03-LTS-SP1: python-setuptools, openEuler:22.03-LTS-SP3: python-setuptools, openEuler:22.03-LTS-SP4: python-setuptools, openEuler:24.03-LTS: python-setuptools</p> <p>Setuptools is a collection of enhancements to the Python distutils that allow you to more easily build and distribute Python packages, especially ones that have dependencies on other packages. Security Fix(es): A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.(CVE-2024-6345)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: python-setuptools, openEuler:22.03-LTS-SP1: python-setuptools, openEuler:22.03-LTS-SP3: python-setuptools, openEuler:22.03-LTS-SP4: python-setuptools, openEuler:24.03-LTS: python-setuptools</p> <p>Setuptools is a collection of enhancements to the Python distutils that allow you to more easily build and distribute Python packages, especially ones that have dependencies on other packages. Security Fix(es): A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.(CVE-2024-6345)</p> https://cve.radiocsirt.org/vuln/oesa-2024-1931 https://cve.radiocsirt.org/vuln/opensuse-su-2024:14294-1 <p>python310-setuptools-72.1.0-1.1 on GA media</p> <p>python310-setuptools-72.1.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:14294-1 https://cve.radiocsirt.org/vuln/pysec-2026-1918 <p><strong>Affected:</strong> PyPI: setuptools</p> <p>A vulnerability in the `package_index` module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.</p> <p><strong>Affected:</strong> PyPI: setuptools</p> <p>A vulnerability in the `package_index` module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.</p> https://cve.radiocsirt.org/vuln/pysec-2026-1918 https://cve.radiocsirt.org/vuln/rhba-2024:5039 <p>pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools python-pymysql: SQL injection if used with untrusted JSON input</p> <p>pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools python-pymysql: SQL injection if used with untrusted JSON input</p> https://cve.radiocsirt.org/vuln/rhba-2024:5039 https://cve.radiocsirt.org/vuln/suse-el-9-client-tools-2024-4029 <p>Security update for SUSE Manager Salt Bundle</p> <p>Security update for SUSE Manager Salt Bundle</p> https://cve.radiocsirt.org/vuln/suse-el-9-client-tools-2024-4029 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-6345 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:14.04:LTS: python-setuptools, Ubuntu:Pro:16.04:LTS: python-setuptools, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:Pro:18.04:LTS: python-setuptools, Ubuntu:Pro:18.04:LTS: python-pip, Ubuntu:20.04:LTS: setuptools, Ubuntu:Pro:20.04:LTS: python-pip, Ubuntu:Pro:20.04:LTS: python-setuptools, Ubuntu:22.04:LTS: setuptools and 2 more</p> <p>A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:14.04:LTS: python-setuptools, Ubuntu:Pro:16.04:LTS: python-setuptools, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:Pro:18.04:LTS: python-setuptools, Ubuntu:Pro:18.04:LTS: python-pip, Ubuntu:20.04:LTS: setuptools, Ubuntu:Pro:20.04:LTS: python-pip, Ubuntu:Pro:20.04:LTS: python-setuptools, Ubuntu:22.04:LTS: setuptools and 2 more</p> <p>A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-6345 https://cve.radiocsirt.org/vuln/vde-2025-053 <p>Coreutils: heap overflow in split --line-bytes with very long lines Unprivileged overlay + shiftfs read access Nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file SSL_select_next_proto buffer overread Remote Code Execution in pypa/setuptools</p> <p>Coreutils: heap overflow in split --line-bytes with very long lines Unprivileged overlay + shiftfs read access Nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file SSL_select_next_proto buffer overread Remote Code Execution in pypa/setuptools</p> https://cve.radiocsirt.org/vuln/vde-2025-053 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1756 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1756