Improper Control of Generation of Code ('Code Injection') Affecting setuptools package, versions [,70.0.0)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-SETUPTOOLS-7448482
- published 15 Jul 2024
- disclosed 15 Jul 2024
- credit CybrX
Introduced: 15 Jul 2024
CVE-2024-6345 Open this link in a new tabHow to fix?
Upgrade setuptools to version 70.0.0 or higher.
Overview
Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') through the package_index module's download functions due to the unsafe usage of os.system. An attacker can execute arbitrary commands on the system by providing malicious URLs or manipulating the URLs retrieved from package index servers.
Note
Because easy_install and package_index are deprecated, the exploitation surface is reduced, but it's conceivable through social engineering or minor compromise to a package index could grant remote access.