Read the docs
TI-2024-05888 Aliases CVE-2024-6345GHSA-cx63-2mw6-8hw5

Remote Code Execution in pypa/setuptools

Priority HIGH 73CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 49 fixed, 9 without a fix

Attack profile from CVSS 3.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.

Summary

A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01939 80th percentileScored 2026-11-07
Fix Partial pypa/setuptools (pypa): 70.0setuptools (PyPI): 70.0.0Red Hat: 38 advisoriesRed Hat: 49 fixed, 9 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pypapypa/setuptoolsbefore 70.070.0Patch availableCNA
—setuptools (PyPI)before 70.0.070.0.0Patch availableGHSA-cx63-2mw6-8hw5
  • pypa/setuptools Vendorpypa Affected before 70.0 Fixed in 70.0 Patch available CNA
  • setuptools (PyPI) Vendor— Affected before 70.0.0 Fixed in 70.0.0 Patch available GHSA-cx63-2mw6-8hw5

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:python:setuptools:69.1.1:*:*:*:*:*:*:*69.1.1—python-pillow
  • cpe:2.3:a:python:setuptools:69.1.1:*:*:*:*:*:*:* Versions 69.1.1 — ·python-pillow

Remediation

  • Fix · CNA pypa/setuptools (pypa) Fixed in 70.0
  • Fix · GHSA-cx63-2mw6-8hw5 setuptools (PyPI) Fixed in 70.0.0 Advisory →

Red Hat 38 advisories

  • RHSA-2026:33154 Released 2026-06-29 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 7.1 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-7-rhel9
  • RHSA-2024:11109 Released 2024-12-16 · Red Hat rating Low
    Updated service-interconnect rhel9 container images for 1.5
    • Red Hat Service Interconnect 1 service-interconnect/skupper-config-sync-rhel9, service-interconnect/skupper-controller-podman-container-rhel9, service-interconnect/skupper-controller-podman-rhel9 +5
  • RHSA-2024:10135 Released 2024-11-21 · Red Hat rating Low
    Updated service-interconnect rhel9 container images for 1.4 LTS
    • 9Base-Service-Interconnect-1.4 service-interconnect/skupper-config-sync-rhel9, service-interconnect/skupper-flow-collector-rhel9, service-interconnect/skupper-operator-bundle +3
Show 35 more Red Hat advisories
  • RHSA-2024:8179 Released 2024-10-16 · Red Hat rating Important
    resource-agents security update
    • Red Hat Enterprise Linux High Availability EUS (v.8.8) resource-agents-4.9.0-40.el8_8.6, resource-agents-aliyun-4.9.0-40.el8_8.6, resource-agents-gcp-4.9.0-40.el8_8.6 +1
    • Red Hat Enterprise Linux Resilient Storage EUS (v.8.8) resource-agents-4.9.0-40.el8_8.6, resource-agents-aliyun-4.9.0-40.el8_8.6, resource-agents-gcp-4.9.0-40.el8_8.6 +1
  • RHSA-2024:8168 Released 2024-10-16 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) fence-agents-4.2.1-112.el8_8.8, fence-agents-all-4.2.1-112.el8_8.8, fence-agents-amt-ws-4.2.1-112.el8_8.8 +40
    • Red Hat Enterprise Linux High Availability EUS (v.8.8) fence-agents-aliyun-4.2.1-112.el8_8.8, fence-agents-aws-4.2.1-112.el8_8.8, fence-agents-azure-arm-4.2.1-112.el8_8.8 +2
    • Red Hat Enterprise Linux Resilient Storage EUS (v.8.8) fence-agents-aliyun-4.2.1-112.el8_8.8, fence-agents-aws-4.2.1-112.el8_8.8, fence-agents-azure-arm-4.2.1-112.el8_8.8 +2
  • RHSA-2024:8171 Released 2024-10-16 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) fence-agents-4.2.1-89.el8_6.14, fence-agents-all-4.2.1-89.el8_6.14, fence-agents-amt-ws-4.2.1-89.el8_6.14 +39
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) fence-agents-4.2.1-89.el8_6.14, fence-agents-all-4.2.1-89.el8_6.14, fence-agents-amt-ws-4.2.1-89.el8_6.14 +40
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) fence-agents-4.2.1-89.el8_6.14, fence-agents-all-4.2.1-89.el8_6.14, fence-agents-amt-ws-4.2.1-89.el8_6.14 +39
    • Red Hat Enterprise Linux High Availability E4S (v.8.6) fence-agents-aliyun-4.2.1-89.el8_6.14, fence-agents-aws-4.2.1-89.el8_6.14, fence-agents-azure-arm-4.2.1-89.el8_6.14 +1
    • Red Hat Enterprise Linux High Availability TUS (v.8.6) fence-agents-aliyun-4.2.1-89.el8_6.14, fence-agents-aws-4.2.1-89.el8_6.14, fence-agents-azure-arm-4.2.1-89.el8_6.14 +1
  • RHSA-2024:8170 Released 2024-10-16 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) fence-agents-4.2.1-65.el8_4.20, fence-agents-all-4.2.1-65.el8_4.20, fence-agents-amt-ws-4.2.1-65.el8_4.20 +39
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) fence-agents-4.2.1-65.el8_4.20, fence-agents-all-4.2.1-65.el8_4.20, fence-agents-amt-ws-4.2.1-65.el8_4.20 +39
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) fence-agents-4.2.1-65.el8_4.20, fence-agents-all-4.2.1-65.el8_4.20, fence-agents-amt-ws-4.2.1-65.el8_4.20 +39
    • Red Hat Enterprise Linux High Availability AUS (v.8.4) fence-agents-aliyun-4.2.1-65.el8_4.20, fence-agents-aws-4.2.1-65.el8_4.20, fence-agents-azure-arm-4.2.1-65.el8_4.20 +1
    • Red Hat Enterprise Linux HighAvailability E4S (v.8.4) fence-agents-aliyun-4.2.1-65.el8_4.20, fence-agents-aws-4.2.1-65.el8_4.20, fence-agents-azure-arm-4.2.1-65.el8_4.20 +1
    • Red Hat Enterprise Linux HighAvailability TUS (v.8.4) fence-agents-aliyun-4.2.1-65.el8_4.20, fence-agents-aws-4.2.1-65.el8_4.20, fence-agents-azure-arm-4.2.1-65.el8_4.20 +1
  • RHSA-2024:8173 Released 2024-10-16 · Red Hat rating Important
    resource-agents security update
    • Red Hat Enterprise Linux High Availability E4S (v.8.6) resource-agents-4.9.0-16.el8_6.14, resource-agents-aliyun-4.9.0-16.el8_6.14, resource-agents-gcp-4.9.0-16.el8_6.14 +1
    • Red Hat Enterprise Linux High Availability TUS (v.8.6) resource-agents-4.9.0-16.el8_6.14, resource-agents-aliyun-4.9.0-16.el8_6.14, resource-agents-gcp-4.9.0-16.el8_6.14 +1
  • RHSA-2024:8172 Released 2024-10-16 · Red Hat rating Important
    resource-agents security update
    • Red Hat Enterprise Linux High Availability AUS (v.8.4) resource-agents-4.1.1-90.el8_4.18, resource-agents-aliyun-4.1.1-90.el8_4.18, resource-agents-gcp-4.1.1-90.el8_4.18
    • Red Hat Enterprise Linux HighAvailability E4S (v.8.4) resource-agents-4.1.1-90.el8_4.18, resource-agents-aliyun-4.1.1-90.el8_4.18, resource-agents-gcp-4.1.1-90.el8_4.18
    • Red Hat Enterprise Linux HighAvailability TUS (v.8.4) resource-agents-4.1.1-90.el8_4.18, resource-agents-aliyun-4.1.1-90.el8_4.18, resource-agents-gcp-4.1.1-90.el8_4.18
  • RHSA-2024:7922 Released 2024-10-16 · Red Hat rating Important
    OpenShift Container Platform 4.17.1 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2024:7374 Released 2024-09-30 · Red Hat rating Low
    Security update for service-interconnect rhel9 container images
    • Red Hat Service Interconnect 1 service-interconnect/skupper-config-sync-rhel9, service-interconnect/skupper-controller-podman-container-rhel9, service-interconnect/skupper-controller-podman-rhel9 +5
  • RHSA-2024:7213 Released 2024-09-26 · Red Hat rating Low
    Updated service-interconnect rhel9 container images for 1.4 LTS
    • 9Base-Service-Interconnect-1.4 service-interconnect/skupper-config-sync-rhel9, service-interconnect/skupper-flow-collector-rhel9, service-interconnect/skupper-operator-bundle +3
  • RHSA-2024:6907 Released 2024-09-23 · Red Hat rating Important
    python-setuptools security update
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) platform-python-setuptools-39.2.0-5.el8_2.1, python-setuptools-39.2.0-5.el8_2.1, python3-setuptools-39.2.0-5.el8_2.1 +1
  • RHSA-2024:6726 Released 2024-09-17 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream (v. 9) fence-agents-4.10.0-62.el9_4.5, fence-agents-common-4.10.0-62.el9_4.5, fence-agents-compute-4.10.0-62.el9_4.5 +11
    • Red Hat Enterprise Linux HighAvailability (v. 9) fence-agents-aliyun-4.10.0-62.el9_4.5, fence-agents-all-4.10.0-62.el9_4.5, fence-agents-amt-ws-4.10.0-62.el9_4.5 +39
    • Red Hat Enterprise Linux ResilientStorage (v. 9) fence-agents-aliyun-4.10.0-62.el9_4.5, fence-agents-all-4.10.0-62.el9_4.5, fence-agents-amt-ws-4.10.0-62.el9_4.5 +39
  • RHSA-2024:6662 Released 2024-09-13 · Red Hat rating Important
    python-setuptools security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) python-setuptools-0.9.8-7.el7_9.1
  • RHSA-2024:6667 Released 2024-09-12 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.16.0 release
    • Red Hat OpenShift Dev Spaces 3 devspaces/code-rhel8, devspaces/configbump-rhel8, devspaces/dashboard-rhel8 +10
  • RHSA-2024:6661 Released 2024-09-12 · Red Hat rating Important
    python3-setuptools security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) python3-setuptools-39.2.0-10.el7_9.1
  • RHSA-2024:6611 Released 2024-09-11 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) fence-agents-4.10.0-43.el9_2.9, fence-agents-common-4.10.0-43.el9_2.9, fence-agents-compute-4.10.0-43.el9_2.9 +11
    • Red Hat Enterprise Linux High Availability EUS (v.9.2) fence-agents-aliyun-4.10.0-43.el9_2.9, fence-agents-all-4.10.0-43.el9_2.9, fence-agents-amt-ws-4.10.0-43.el9_2.9 +39
    • Red Hat Enterprise Linux Resilient Storage EUS (v.9.2) fence-agents-aliyun-4.10.0-43.el9_2.9, fence-agents-all-4.10.0-43.el9_2.9, fence-agents-amt-ws-4.10.0-43.el9_2.9 +39
  • RHSA-2024:6612 Released 2024-09-11 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) fence-agents-4.10.0-20.el9_0.17, fence-agents-common-4.10.0-20.el9_0.17, fence-agents-compute-4.10.0-20.el9_0.17 +12
    • Red Hat Enterprise Linux High Availability E4S (v.9.0) fence-agents-aliyun-4.10.0-20.el9_0.17, fence-agents-all-4.10.0-20.el9_0.17, fence-agents-amt-ws-4.10.0-20.el9_0.17 +39
    • Red Hat Enterprise Linux ResilientStorage E4S (v.9.0) fence-agents-aliyun-4.10.0-20.el9_0.17, fence-agents-all-4.10.0-20.el9_0.17, fence-agents-amt-ws-4.10.0-20.el9_0.17 +39
  • RHSA-2024:6488 Released 2024-09-09 · Red Hat rating Important
    python39:3.9 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) PyYAML-5.4.1-1.module+el8.4.0+10484+27ce8e03.src::python39:3.9, mod_wsgi-4.7.1-4.module+el8.4.0+9822+20bf1249.src::python39:3.9, numpy-1.19.4-2.module+el8.4.0+15042+dc5a279b.1.src::python39:3.9 +47
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) PyYAML-5.4.1-1.module+el8.4.0+10484+27ce8e03.src::python39:3.9, mod_wsgi-4.7.1-4.module+el8.4.0+9822+20bf1249.src::python39:3.9, numpy-1.19.4-2.module+el8.4.0+15042+dc5a279b.1.src::python39:3.9 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) PyYAML-5.4.1-1.module+el8.4.0+10484+27ce8e03.src::python39:3.9, mod_wsgi-4.7.1-4.module+el8.4.0+9822+20bf1249.src::python39:3.9, numpy-1.19.4-2.module+el8.4.0+15042+dc5a279b.1.src::python39:3.9 +47
  • RHSA-2024:6309 Released 2024-09-04 · Red Hat rating Moderate
    fence-agents security update
    • Red Hat Enterprise Linux AppStream (v. 8) fence-agents-4.2.1-129.el8_10.4, fence-agents-all-4.2.1-129.el8_10.4, fence-agents-amt-ws-4.2.1-129.el8_10.4 +40
    • Red Hat Enterprise Linux HighAvailability (v. 8) fence-agents-aliyun-4.2.1-129.el8_10.4, fence-agents-aws-4.2.1-129.el8_10.4, fence-agents-azure-arm-4.2.1-129.el8_10.4 +2
    • Red Hat Enterprise Linux ResilientStorage (v. 8) fence-agents-aliyun-4.2.1-129.el8_10.4, fence-agents-aws-4.2.1-129.el8_10.4, fence-agents-azure-arm-4.2.1-129.el8_10.4 +2
  • RHSA-2024:6312 Released 2024-09-04 · Red Hat rating Important
    python3.11-setuptools security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) python3.11-setuptools-65.5.1-2.el9_2.1, python3.11-setuptools-wheel-65.5.1-2.el9_2.1
  • RHSA-2024:6311 Released 2024-09-04 · Red Hat rating Moderate
    resource-agents security update
    • Red Hat Enterprise Linux HighAvailability (v. 8) resource-agents-4.9.0-54.el8_10.4, resource-agents-aliyun-4.9.0-54.el8_10.4, resource-agents-gcp-4.9.0-54.el8_10.4 +1
    • Red Hat Enterprise Linux ResilientStorage (v. 8) resource-agents-4.9.0-54.el8_10.4, resource-agents-aliyun-4.9.0-54.el8_10.4, resource-agents-gcp-4.9.0-54.el8_10.4 +1
  • RHSA-2024:6220 Released 2024-09-03 · Red Hat rating Important
    python39:3.9 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) PyYAML-5.4.1-1.module+el8.5.0+10613+59a13ec4.src::python39:3.9, mod_wsgi-4.7.1-4.module+el8.4.0+9822+20bf1249.src::python39:3.9, numpy-1.19.4-3.module+el8.5.0+12204+54860423.src::python39:3.9 +47
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) PyYAML-5.4.1-1.module+el8.5.0+10613+59a13ec4.src::python39:3.9, mod_wsgi-4.7.1-4.module+el8.4.0+9822+20bf1249.src::python39:3.9, numpy-1.19.4-3.module+el8.5.0+12204+54860423.src::python39:3.9 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) PyYAML-5.4.1-1.module+el8.5.0+10613+59a13ec4.src::python39:3.9, mod_wsgi-4.7.1-4.module+el8.4.0+9822+20bf1249.src::python39:3.9, numpy-1.19.4-3.module+el8.5.0+12204+54860423.src::python39:3.9 +47
  • RHSA-2024:5962 Released 2024-08-28 · Red Hat rating Moderate
    python39:3.9 and python39-devel:3.9 security update
    • Red Hat Enterprise Linux AppStream (v. 8) PyYAML-5.4.1-1.module+el8.9.0+19644+d68f775d.src::python39:3.9, mod_wsgi-4.7.1-7.module+el8.9.0+19644+d68f775d.src::python39:3.9, numpy-1.19.4-3.module+el8.9.0+19644+d68f775d.src::python39:3.9 +47
    • Red Hat Enterprise Linux CRB (v. 8) Cython-0.29.21-5.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9, pybind11-2.7.1-1.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9, pytest-6.0.2-2.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9 +33
  • RHSA-2024:5532 Released 2024-08-19 · Red Hat rating Important
    python3.11-setuptools security update
    • Red Hat Enterprise Linux AppStream (v. 8) python3.11-setuptools-65.5.1-3.el8_10, python3.11-setuptools-wheel-65.5.1-3.el8_10
  • RHSA-2024:5534 Released 2024-08-19 · Red Hat rating Important
    python-setuptools security update
    • Red Hat Enterprise Linux BaseOS (v. 9) python-setuptools-53.0.0-12.el9_4.1, python3-setuptools-53.0.0-12.el9_4.1, python3-setuptools-wheel-53.0.0-12.el9_4.1
  • RHSA-2024:5533 Released 2024-08-19 · Red Hat rating Important
    python3.12-setuptools security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.12-setuptools-68.2.2-3.el9_4.1
    • Red Hat Enterprise Linux CRB (v. 9) python3.12-setuptools-wheel-68.2.2-3.el9_4.1
  • RHSA-2024:5531 Released 2024-08-19 · Red Hat rating Important
    python3.12-setuptools security update
    • Red Hat Enterprise Linux AppStream (v. 8) python3.12-setuptools-68.2.2-4.el8_10
    • Red Hat Enterprise Linux CRB (v. 8) python3.12-setuptools-wheel-68.2.2-4.el8_10
  • RHSA-2024:5530 Released 2024-08-19 · Red Hat rating Important
    python-setuptools security update
    • Red Hat Enterprise Linux BaseOS (v. 8) platform-python-setuptools-39.2.0-8.el8_10, python-setuptools-39.2.0-8.el8_10, python3-setuptools-39.2.0-8.el8_10 +1
  • RHSA-2024:5279 Released 2024-08-15 · Red Hat rating Important
    python3.11-setuptools security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.11-setuptools-65.5.1-2.el9_4.1, python3.11-setuptools-wheel-65.5.1-2.el9_4.1
  • RHSA-2024:5389 Released 2024-08-14 · Red Hat rating Important
    python-setuptools security update
    • Red Hat Enterprise Linux BaseOS E4S (v.9.0) python-setuptools-53.0.0-12.el9_0, python3-setuptools-53.0.0-12.el9_0, python3-setuptools-wheel-53.0.0-12.el9_0
  • RHSA-2024:5137 Released 2024-08-08 · Red Hat rating Important
    python-setuptools security update
    • Red Hat Enterprise Linux BaseOS EUS (v.9.2) python-setuptools-53.0.0-12.el9_2.1, python3-setuptools-53.0.0-12.el9_2.1, python3-setuptools-wheel-53.0.0-12.el9_2.1
  • RHSA-2024:5084 Released 2024-08-07 · Red Hat rating Important
    python39:3.9 and python39-devel:3.9 security update
    • Red Hat CodeReady Linux Builder EUS (v.8.8) Cython-0.29.21-5.module+el8.4.0+9822+20bf1249.src::python39-devel:3.9, pybind11-2.7.1-1.module+el8.6.0+12838+640e6226.src::python39-devel:3.9, pytest-6.0.2-2.module+el8.4.0+9822+20bf1249.src::python39-devel:3.9 +33
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) PyYAML-5.4.1-1.module+el8.5.0+10613+59a13ec4.src::python39:3.9, mod_wsgi-4.7.1-5.module+el8.7.0+16654+645aad7f.src::python39:3.9, numpy-1.19.4-3.module+el8.5.0+12204+54860423.src::python39:3.9 +47
  • RHSA-2024:5078 Released 2024-08-07 · Red Hat rating Important
    python-setuptools security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) platform-python-setuptools-39.2.0-6.el8_4.1, python-setuptools-39.2.0-6.el8_4.1, python3-setuptools-39.2.0-6.el8_4.1 +1
    • Red Hat Enterprise Linux BaseOS E4S (v.8.4) platform-python-setuptools-39.2.0-6.el8_4.1, python-setuptools-39.2.0-6.el8_4.1, python3-setuptools-39.2.0-6.el8_4.1 +1
    • Red Hat Enterprise Linux BaseOS TUS (v.8.4) platform-python-setuptools-39.2.0-6.el8_4.1, python-setuptools-39.2.0-6.el8_4.1, python3-setuptools-39.2.0-6.el8_4.1 +1
  • RHSA-2024:5040 Released 2024-08-06 · Red Hat rating Important
    python-setuptools security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) platform-python-setuptools-39.2.0-7.el8_6.1, python-setuptools-39.2.0-7.el8_6.1, python3-setuptools-39.2.0-7.el8_6.1 +1
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) platform-python-setuptools-39.2.0-7.el8_6.1, python-setuptools-39.2.0-7.el8_6.1, python3-setuptools-39.2.0-7.el8_6.1 +1
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) platform-python-setuptools-39.2.0-7.el8_6.1, python-setuptools-39.2.0-7.el8_6.1, python3-setuptools-39.2.0-7.el8_6.1 +1
  • RHSA-2024:5000 Released 2024-08-06 · Red Hat rating Important
    python-setuptools security update
    • Red Hat Enterprise Linux BaseOS EUS (v.8.8) platform-python-setuptools-39.2.0-7.el8_8.1, python-setuptools-39.2.0-7.el8_8.1, python3-setuptools-39.2.0-7.el8_8.1 +1
  • RHSA-2024:5002 Released 2024-08-06 · Red Hat rating Important
    python3.11-setuptools security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) python3.11-setuptools-65.5.1-2.el8_8.1, python3.11-setuptools-wheel-65.5.1-2.el8_8.1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Multiarch Tuning OperatorAffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Ceph Storage 7AffectedNo fix yet
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Data Science (RHODS)AffectedNo fix yet
9Base-Service-Interconnect-1.4Fixed RHSA-2024:10135, RHSA-2024:7213
Quay v3Fixed—
Red Hat Ceph Storage 7.1Fixed RHSA-2026:33154
Red Hat CodeReady Linux Builder EUS (v.8.8)Fixed RHSA-2024:5084
Red Hat Developer Hub 1.2 for RHEL 9Fixed—
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:5531, RHSA-2024:5532, RHSA-2024:5962, RHSA-2024:6309
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:5279, RHSA-2024:5533, RHSA-2024:6726
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2024:6488, RHSA-2024:8170
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2024:6220, RHSA-2024:8171
Red Hat Enterprise Linux AppStream E4S (v.8.4)Fixed RHSA-2024:6488, RHSA-2024:8170
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2024:6220, RHSA-2024:8171
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2024:6612
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2024:5002, RHSA-2024:5084, RHSA-2024:8168
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2024:6312, RHSA-2024:6611
Red Hat Enterprise Linux AppStream TUS (v.8.4)Fixed RHSA-2024:6488, RHSA-2024:8170
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2024:6220, RHSA-2024:8171
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2024:5530
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2024:5534
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2024:6907
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2024:5078
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2024:5040
Red Hat Enterprise Linux BaseOS E4S (v.8.4)Fixed RHSA-2024:5078
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2024:5040
Red Hat Enterprise Linux BaseOS E4S (v.9.0)Fixed RHSA-2024:5389
Red Hat Enterprise Linux BaseOS EUS (v.8.8)Fixed RHSA-2024:5000
Red Hat Enterprise Linux BaseOS EUS (v.9.2)Fixed RHSA-2024:5137
Red Hat Enterprise Linux BaseOS TUS (v.8.4)Fixed RHSA-2024:5078
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2024:5040
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2024:5531, RHSA-2024:5962
Red Hat Enterprise Linux CRB (v. 9)Fixed RHSA-2024:5533
Red Hat Enterprise Linux High Availability AUS (v.8.4)Fixed RHSA-2024:8170, RHSA-2024:8172
Red Hat Enterprise Linux High Availability E4S (v.8.6)Fixed RHSA-2024:8171, RHSA-2024:8173
Red Hat Enterprise Linux High Availability E4S (v.9.0)Fixed RHSA-2024:6612
Red Hat Enterprise Linux High Availability EUS (v.8.8)Fixed RHSA-2024:8168, RHSA-2024:8179
Red Hat Enterprise Linux High Availability EUS (v.9.2)Fixed RHSA-2024:6611
Red Hat Enterprise Linux High Availability TUS (v.8.6)Fixed RHSA-2024:8171, RHSA-2024:8173
Red Hat Enterprise Linux HighAvailability (v. 8)Fixed RHSA-2024:6309, RHSA-2024:6311
Red Hat Enterprise Linux HighAvailability (v. 9)Fixed RHSA-2024:6726
Red Hat Enterprise Linux HighAvailability E4S (v.8.4)Fixed RHSA-2024:8170, RHSA-2024:8172
Red Hat Enterprise Linux HighAvailability TUS (v.8.4)Fixed RHSA-2024:8170, RHSA-2024:8172
Red Hat Enterprise Linux Resilient Storage EUS (v.8.8)Fixed RHSA-2024:8168, RHSA-2024:8179
Red Hat Enterprise Linux Resilient Storage EUS (v.9.2)Fixed RHSA-2024:6611
Red Hat Enterprise Linux ResilientStorage (v. 8)Fixed RHSA-2024:6309, RHSA-2024:6311
Red Hat Enterprise Linux ResilientStorage (v. 9)Fixed RHSA-2024:6726
Red Hat Enterprise Linux ResilientStorage E4S (v.9.0)Fixed RHSA-2024:6612
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2024:6661, RHSA-2024:6662
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2024:7922
Red Hat OpenShift Dev Spaces 3Fixed RHSA-2024:6667
Red Hat Service Interconnect 1Fixed RHSA-2024:11109, RHSA-2024:7374
Not affected: 17 products
  • Logging Subsystem for Red Hat OpenShift
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ceph Storage 7.1
  • Red Hat Developer Hub 1
  • Red Hat Developer Hub 1.2 for RHEL 9
  • Red Hat Discovery 1
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Data Science (RHODS)
  • Red Hat OpenStack Platform 16.1
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat Satellite 6
  • Service Telemetry Framework 1.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-6345
  2. 2026-10-03 Alias added: GHSA-cx63-2mw6-8hw5
  3. 2026-10-27 Affected versions changed · Red Hat

References

Advisory 1

Other 5

  • TI-2025-29803 setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write CVSS 4.0HIGH 7.7
  • TI-2026-78525 Shell command injection in virtualenv generated POSIX launchers CVSS 3.1HIGH 7.8
  • TI-2026-78526 Command injection in virtualenv bash activation prompt CVSS 4.0HIGH 7.1
  • TI-2026-78521 Code injection in virtualenv Xonsh activation script CVSS 4.0HIGH 7.1
  • TI-2026-19377 wheel Allows Arbitrary File Permission Modification via Path Traversal CVSS 3.1HIGH 7.1
  • TI-2026-42704 setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+ CVSS 3.1MEDIUM 6.1
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences