setuptools@0.6c3 vulnerabilities

Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') through the package_index module's download functions due to the unsafe usage of os.system. An attacker can execute arbitrary commands on the system by providing malicious URLs or manipulating the URLs retrieved from package index servers.

Note

Because easy_install and package_index are deprecated, the exploitation surface is reduced, but it's conceivable through social engineering or minor compromise to a package index could grant remote access.

Upgrade setuptools to version 70.0.0 or higher.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTML package or custom PackageIndex page.

Note:

Only a small portion of the user base is impacted by this flaw. Setuptools maintainers pointed out that package_index is deprecated (not formally, but “in spirit”) and the vulnerability isn't reachable through standard, recommended workflows.

Upgrade setuptools to version 65.5.1 or higher.

Affected versions of setuptools are vulnerable to Directory Traversal.

ez_setup._extractall() doesn't validate the tar file members. member.name can start with / or to contain / which malicious attacker can exploit to Directory Traversal attacks.

Upgrade setuptools to version 3.0 or higher.

Affected versions of setuptools are vulnerable to Man-in-the-Middle (MitM) attack.

The ssl.match_hostname function does not properly handle wildcards in hostnames, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate. (same as CVE-2013-7440).

Upgrade setuptools to version 1.3 or higher.

Affected versions of setuptools are vulnerable to Denial of Service (DoS) attacks.

Algorithmic complexity vulnerability in the ssl.match_hostname function, allows remote attackers to cause a denial of service (CPU consumption) via multiple wildcard characters in the common name in a certificate.(same issue as CVE-2013-2099).

Upgrade setuptools to version 0.9.5 or higher.

setuptools is a Easily download, build, install, upgrade, and uninstall Python packages easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.