CVE-2022-40897: pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS)
(updated )
Python Packaging Authority (PyPA)’s setuptools is a library designed to facilitate packaging Python projects. Setuptools version 65.5.0 and earlier could allow remote attackers to cause a denial of service by fetching malicious HTML from a PyPI package or custom PackageIndex page due to a vulnerable Regular Expression in package_index. This has been patched in version 65.5.1.
References
- github.com/advisories/GHSA-r9hx-vwmv-q579
- github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2022-43012.yaml
- github.com/pypa/setuptools
- github.com/pypa/setuptools/blob/fe8a98e696241487ba6ac9f91faa38ade939ec5d/setuptools/package_index.py
- github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be
- github.com/pypa/setuptools/compare/v65.5.0...v65.5.1
- github.com/pypa/setuptools/issues/3659
- lists.debian.org/debian-lts-announce/2024/09/msg00018.html
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ADES3NLOE5QJKBLGNZNI2RGVOSQXA37R
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YNA2BAH2ACBZ4TVJZKFLCR7L23BG5C3H
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ADES3NLOE5QJKBLGNZNI2RGVOSQXA37R
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YNA2BAH2ACBZ4TVJZKFLCR7L23BG5C3H
- nvd.nist.gov/vuln/detail/CVE-2022-40897
- pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages
- pyup.io/vulnerabilities/CVE-2022-40897/52495
- security.netapp.com/advisory/ntap-20230214-0001
- security.netapp.com/advisory/ntap-20240621-0006
- setuptools.pypa.io/en/latest
Code Behaviors & Features
Detect and mitigate CVE-2022-40897 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →