Loading vulnerability…
Remote code execution in PyPA setuptools package_index download functions
CVE-2024-6345 is a code-injection vulnerability in the package_index module of PyPA setuptools, affecting versions through 69.1.1. Its download functions process package URLs supplied by users or obtained from package index servers. Shell-based execution of download operations, including Git cloning, allows attacker-controlled input to execute arbitrary system commands. Exploitation requires a vulnerable download function to process malicious input; merely having setuptools installed does not establish exploitability. Setuptools 70.0 fixes the issue by replacing shell-based Git execution using os.system with subprocess.check_call using an argument list.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary command execution with the privileges of the process invoking the vulnerable setuptools download functions. This can compromise the confidentiality, integrity, and availability of the affected environment, including access to sensitive data, modification of files or build outputs, and service disruption. The vulnerability does not independently establish privilege escalation beyond the executing process's permissions.
If you can’t patch tonight, do this now.
Until patched, prevent untrusted package URLs and package-index-derived inputs from reaching the vulnerable package_index download functions. Restrict package sources to trusted, controlled repositories and avoid workflows that invoke these functions on attacker-controlled inputs. Run package download and build operations with least privilege and isolation to limit potential impact. These exposure-reduction measures are not a substitute for installing the fix; no vulnerability-specific vendor workaround is established.
Patch, then assume compromise.
Upgrade upstream setuptools to version 70.0 or later, or install the applicable vendor package containing a backported fix. Fixed distribution packages may retain older upstream version numbers, so verify vendor advisory and package release information rather than relying solely on the setuptools version. Examples include RHEL 8 python3-setuptools 39.2.0-8.el8_10 and RHEL 9 python3-setuptools 53.0.0-12.el9_4.1. Update affected container base images and rebuild dependent images to incorporate patched packages.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
50 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.