Update dependency setuptools to v78 [SECURITY] #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Open

renovate wants to merge 1 commit into main

from renovate/pypi-setuptools-vulnerability

Open

Update dependency setuptools to v78 [SECURITY] #22

renovate wants to merge 1 commit into main from renovate/pypi-setuptools-vulnerability

Conversation

@renovate

Copy link

Contributor

@renovate renovate bot commented May 20, 2025 •

edited

Loading

This PR contains the following updates:

Package	Change	Age	Confidence
setuptools (changelog)	`~=70.0.0` → `~=78.1.1`	age	confidence

GitHub Vulnerability Alerts

CVE-2025-47273

Summary

A path traversal vulnerability in PackageIndex was fixed in setuptools version 78.1.1

Details

 def _download_url(self, url, tmpdir):
 # Determine download filename
 #
 name, _fragment = egg_info_for_url(url)
 if name:
 while '..' in name:
 name = name.replace('..', '.').replace('\\', '_')
 else:
 name = "__downloaded__" # default if URL has no path contents
 if name.endswith('.[egg.zip](http://egg.zip/)'):
 name = name[:-4] # strip the extra .zip before download
 --> filename = os.path.join(tmpdir, name)

Here: https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88

os.path.join() discards the first argument tmpdir if the second begins with a slash or drive letter.
name is derived from a URL without sufficient sanitization. While there is some attempt to sanitize by replacing instances of '..' with '.', it is insufficient.

Risk Assessment

As easy_install and package_index are deprecated, the exploitation surface is reduced.
However, it seems this could be exploited in a similar fashion like GHSA-r9hx-vwmv-q579, and as described by POC 4 in GHSA-cx63-2mw6-8hw5 report: via malicious URLs present on the pages of a package index.

Impact

An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

References

https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
https://github.com/pypa/setuptools/issues/4946

Release Notes

pypa/setuptools (setuptools)

Update dependency setuptools to v78 [SECURITY] #22

Are you sure you want to change the base?

Update dependency setuptools to v78 [SECURITY] #22

Uh oh!

Conversation

@renovate renovate bot commented May 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

Summary

Details

Risk Assessment

Impact

References

Release Notes

Configuration

Uh oh!

sourcery-ai bot commented May 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer's Guide

Sequence Diagram: CVE-2025-47273 Path Traversal Vulnerability in setuptools < 78.1.1

File-Level Changes

Possibly linked issues

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

@renovate renovate bot commented May 20, 2025 •

edited

Loading

sourcery-ai bot commented May 20, 2025 •

edited

Loading