Arbitrary Code Injection Affecting py3-cassandra-medusa package, versions <0.21.0-r6


Severity

Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.04% (11th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Arbitrary Code Injection vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-CHAINGUARDLATEST-PY3CASSANDRAMEDUSA-7461650
  • published16 Jul 2024
  • disclosed15 Jul 2024

Introduced: 15 Jul 2024

CVE-2024-6345  (opens in a new tab)
CWE-94  (opens in a new tab)

How to fix?

Upgrade Chainguard py3-cassandra-medusa to version 0.21.0-r6 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream py3-cassandra-medusa package and not the py3-cassandra-medusa package as distributed by Chainguard. See How to fix? for Chainguard relevant fixed versions and status.

A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.

CVSS Scores

version 3.1