setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write
Priority HIGH 73CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 48 fixed, 12 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01592 75th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial setuptools (pypa): 78.1.1setuptools (PyPI): 78.1.1Red Hat: 46 advisoriesRed Hat: 48 fixed, 12 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pypa | setuptools | before 78.1.1 | 78.1.1 | Patch available | CNA |
| — | setuptools (PyPI) | before 78.1.1 | 78.1.1 | Patch available | GHSA-5rjg-fvgr-3xxf |
- setuptools Vendorpypa Affected before 78.1.1 Fixed in 78.1.1 Patch available CNA
- setuptools (PyPI) Vendor— Affected before 78.1.1 Fixed in 78.1.1 Patch available GHSA-5rjg-fvgr-3xxf
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:setuptools:*:*:*:*:*:*:*:* | before 78.1.1 | Vulnerable | python-pillow |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
- cpe:2.3:a:python:setuptools:*:*:*:*:*:*:*:* Versions before 78.1.1 Vulnerable ·python-pillow
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
Remediation
- Fix · CNA setuptools (pypa) Fixed in 78.1.1
- Fix · GHSA-5rjg-fvgr-3xxf setuptools (PyPI) Fixed in 78.1.1 Advisory →
Red Hat 46 advisories
- RHSA-2026:4215 Released 2026-03-10 · Red Hat rating ImportantRed Hat Quay 3.14.6
- Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
- RHSA-2025:19430 Released 2025-11-03 · Red Hat rating ImportantRed Hat Enterprise Linux AI 1.5 (NVIDIA)
- Red Hat Enterprise Linux AI 1.5 registry.redhat.io/rhelai1/bootc-azure-nvidia-rhel9
- RHSA-2025:19429 Released 2025-11-03 · Red Hat rating ImportantRed Hat Enterprise Linux AI 1.5 (NVIDIA)
- Red Hat Enterprise Linux AI 1.5 registry.redhat.io/rhelai1/bootc-aws-nvidia-rhel9
Show 43 more Red Hat advisories
- RHSA-2025:19428 Released 2025-11-03 · Red Hat rating ImportantRed Hat Enterprise Linux AI 1.5 (NVIDIA)
- Red Hat Enterprise Linux AI 1.5 registry.redhat.io/rhelai1/bootc-nvidia-rhel9
- RHSA-2025:19427 Released 2025-11-03 · Red Hat rating ImportantRed Hat Enterprise Linux AI 1.5 (AMD)
- Red Hat Enterprise Linux AI 1.5 registry.redhat.io/rhelai1/bootc-amd-rhel9
- RHSA-2025:19426 Released 2025-11-03 · Red Hat rating ImportantRed Hat Enterprise Linux AI 1.5 (NVIDIA)
- Red Hat Enterprise Linux AI 1.5 registry.redhat.io/rhelai1/bootc-gcp-nvidia-rhel9
- RHSA-2025:19425 Released 2025-11-03 · Red Hat rating ImportantRed Hat Enterprise Linux AI 1.5 (AMD)
- Red Hat Enterprise Linux AI 1.5 registry.redhat.io/rhelai1/instructlab-amd-rhel9
- RHSA-2025:19424 Released 2025-11-03 · Red Hat rating ImportantRed Hat Enterprise Linux AI 1.5 (AMD)
- Red Hat Enterprise Linux AI 1.5 registry.redhat.io/rhelai1/bootc-azure-amd-rhel9
- RHSA-2025:19423 Released 2025-11-03 · Red Hat rating ImportantRed Hat Enterprise Linux AI 1.5 (NVIDIA)
- Red Hat Enterprise Linux AI 1.5 registry.redhat.io/rhelai1/instructlab-nvidia-rhel9
- RHSA-2025:19422 Released 2025-11-03 · Red Hat rating ImportantRed Hat Enterprise Linux AI 1.5 (Intel Gaudi)
- Red Hat Enterprise Linux AI 1.5 registry.redhat.io/rhelai1/bootc-intel-rhel9
- RHSA-2025:19421 Released 2025-11-03 · Red Hat rating ImportantRed Hat Enterprise Linux AI 1.5 (Intel Gaudi)
- Red Hat Enterprise Linux AI 1.5 registry.redhat.io/rhelai1/instructlab-intel-rhel9
- RHSA-2025:15410 Released 2025-09-08 · Red Hat rating Moderatepython39:3.9 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) PyYAML-5.4.1-1.module+el8.5.0+10613+59a13ec4.src::python39:3.9, mod_wsgi-4.7.1-4.module+el8.4.0+9822+20bf1249.src::python39:3.9, numpy-1.19.4-3.module+el8.5.0+12204+54860423.src::python39:3.9 +47
- Red Hat Enterprise Linux AppStream E4S (v.8.6) PyYAML-5.4.1-1.module+el8.5.0+10613+59a13ec4.src::python39:3.9, mod_wsgi-4.7.1-4.module+el8.4.0+9822+20bf1249.src::python39:3.9, numpy-1.19.4-3.module+el8.5.0+12204+54860423.src::python39:3.9 +47
- Red Hat Enterprise Linux AppStream TUS (v.8.6) PyYAML-5.4.1-1.module+el8.5.0+10613+59a13ec4.src::python39:3.9, mod_wsgi-4.7.1-4.module+el8.4.0+9822+20bf1249.src::python39:3.9, numpy-1.19.4-3.module+el8.5.0+12204+54860423.src::python39:3.9 +47
- RHSA-2025:15408 Released 2025-09-08 · Red Hat rating Moderatepython39:3.9 security update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) PyYAML-5.4.1-1.module+el8.5.0+10613+59a13ec4.src::python39:3.9, mod_wsgi-4.7.1-5.module+el8.7.0+16654+645aad7f.src::python39:3.9, numpy-1.19.4-3.module+el8.5.0+12204+54860423.src::python39:3.9 +47
- RHSA-2025:15411 Released 2025-09-08 · Red Hat rating Moderatepython39:3.9 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) PyYAML-5.4.1-1.module+el8.4.0+10484+27ce8e03.src::python39:3.9, mod_wsgi-4.7.1-4.module+el8.4.0+9822+20bf1249.src::python39:3.9, numpy-1.19.4-2.module+el8.4.0+15042+dc5a279b.1.src::python39:3.9 +47
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) PyYAML-5.4.1-1.module+el8.4.0+10484+27ce8e03.src::python39:3.9, mod_wsgi-4.7.1-4.module+el8.4.0+9822+20bf1249.src::python39:3.9, numpy-1.19.4-2.module+el8.4.0+15042+dc5a279b.1.src::python39:3.9 +47
- RHSA-2025:14900 Released 2025-08-28 · Red Hat rating Moderatepython39:3.9 security update
- Red Hat Enterprise Linux AppStream (v. 8) PyYAML-5.4.1-1.module+el8.9.0+19644+d68f775d.src::python39:3.9, mod_wsgi-4.7.1-7.module+el8.10.0+23075+0aa18782.1.src::python39:3.9, numpy-1.19.4-3.module+el8.9.0+19644+d68f775d.src::python39:3.9 +47
- Red Hat Enterprise Linux CRB (v. 8) Cython-0.29.21-5.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9, pybind11-2.7.1-1.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9, pytest-6.0.2-2.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9 +33
- RHSA-2025:14686 Released 2025-08-26 · Red Hat rating ModerateRed Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-4.6.19-1.el8ap, automation-controller-cli-4.6.19-1.el8ap, automation-controller-server-4.6.19-1.el8ap +3
- Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-4.6.19-1.el9ap, automation-controller-cli-4.6.19-1.el9ap, automation-controller-server-4.6.19-1.el9ap +3
- RHSA-2025:13804 Released 2025-08-13 · Red Hat rating Moderatepython3.11-setuptools security update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) python3.11-setuptools-65.5.1-2.el8_8.2, python3.11-setuptools-wheel-65.5.1-2.el8_8.2
- Red Hat Enterprise Linux AppStream TUS (v.8.8) python3.11-setuptools-65.5.1-2.el8_8.2, python3.11-setuptools-wheel-65.5.1-2.el8_8.2
- RHSA-2025:13803 Released 2025-08-13 · Red Hat rating Moderatepython3.11-setuptools security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) python3.11-setuptools-65.5.1-2.el9_2.2, python3.11-setuptools-wheel-65.5.1-2.el9_2.2
- RHSA-2025:13668 Released 2025-08-12 · Red Hat rating Moderatepython3.12-setuptools security update
- Red Hat CodeReady Linux Builder EUS (v.9.4) python3.12-setuptools-wheel-68.2.2-3.el9_4.2
- Red Hat Enterprise Linux AppStream EUS (v.9.4) python3.12-setuptools-68.2.2-3.el9_4.2
- RHSA-2025:13669 Released 2025-08-12 · Red Hat rating Moderatepython3.11-setuptools security update
- Red Hat Enterprise Linux AppStream EUS (v.9.4) python3.11-setuptools-65.5.1-2.el9_4.2, python3.11-setuptools-wheel-65.5.1-2.el9_4.2
- RHSA-2025:13578 Released 2025-08-11 · Red Hat rating Moderatepython3.11-setuptools security update
- Red Hat Enterprise Linux AppStream (v. 9) python3.11-setuptools-65.5.1-4.el9_6, python3.11-setuptools-wheel-65.5.1-4.el9_6
- RHSA-2025:12834 Released 2025-08-05 · Red Hat rating Moderatepython3.12-setuptools security update
- Red Hat Enterprise Linux AppStream (v. 9) python3.12-setuptools-68.2.2-5.el9_6
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3.12-setuptools-wheel-68.2.2-5.el9_6
- RHSA-2025:12020 Released 2025-07-29 · Red Hat rating Moderatepython-setuptools security update
- Red Hat Enterprise Linux BaseOS E4S (v.9.2) python-setuptools-53.0.0-12.el9_2.3, python3-setuptools-53.0.0-12.el9_2.3, python3-setuptools-wheel-53.0.0-12.el9_2.3
- RHSA-2025:11984 Released 2025-07-28 · Red Hat rating Moderatepython-setuptools security update
- Red Hat Enterprise Linux Server (v. 7 ELS) python-setuptools-0.9.8-7.el7_9.2
- RHSA-2025:11868 Released 2025-07-28 · Red Hat rating Moderatepython-setuptools security update
- Red Hat Enterprise Linux BaseOS EUS (v.9.4) python-setuptools-53.0.0-12.el9_4.2, python3-setuptools-53.0.0-12.el9_4.2, python3-setuptools-wheel-53.0.0-12.el9_4.2
- RHSA-2025:11607 Released 2025-07-23 · Red Hat rating Moderatepython3-setuptools security update
- Red Hat Enterprise Linux Server (v. 7 ELS) python3-setuptools-39.2.0-10.el7_9.2
- RHSA-2025:11584 Released 2025-07-23 · Red Hat rating Moderatepython-setuptools security update
- Red Hat Enterprise Linux BaseOS E4S (v.9.0) python-setuptools-53.0.0-13.el9_0, python3-setuptools-53.0.0-13.el9_0, python3-setuptools-wheel-53.0.0-13.el9_0
- RHSA-2025:11463 Released 2025-07-21 · Red Hat rating Moderatefence-agents security update
- Red Hat Enterprise Linux AppStream (v. 9) fence-agents-4.10.0-86.el9_6.7, fence-agents-aliyun-4.10.0-86.el9_6.7, fence-agents-all-4.10.0-86.el9_6.7 +47
- Red Hat Enterprise Linux High Availability (v. 9) ha-cloud-support-4.10.0-86.el9_6.7
- Red Hat Enterprise Linux Resilient Storage (v. 9) ha-cloud-support-4.10.0-86.el9_6.7
- RHSA-2025:11464 Released 2025-07-21 · Red Hat rating Moderatefence-agents security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) fence-agents-4.10.0-20.el9_0.23, fence-agents-common-4.10.0-20.el9_0.23, fence-agents-compute-4.10.0-20.el9_0.23 +12
- Red Hat Enterprise Linux High Availability E4S (v.9.0) fence-agents-aliyun-4.10.0-20.el9_0.23, fence-agents-all-4.10.0-20.el9_0.23, fence-agents-amt-ws-4.10.0-20.el9_0.23 +39
- Red Hat Enterprise Linux ResilientStorage E4S (v.9.0) fence-agents-aliyun-4.10.0-20.el9_0.23, fence-agents-all-4.10.0-20.el9_0.23, fence-agents-amt-ws-4.10.0-20.el9_0.23 +39
- RHSA-2025:11424 Released 2025-07-21 · Red Hat rating Moderatepython-setuptools security update
- Red Hat Enterprise Linux BaseOS AUS (v.8.6) platform-python-setuptools-39.2.0-7.el8_6.2, python-setuptools-39.2.0-7.el8_6.2, python3-setuptools-39.2.0-7.el8_6.2 +1
- Red Hat Enterprise Linux BaseOS E4S (v.8.6) platform-python-setuptools-39.2.0-7.el8_6.2, python-setuptools-39.2.0-7.el8_6.2, python3-setuptools-39.2.0-7.el8_6.2 +1
- Red Hat Enterprise Linux BaseOS TUS (v.8.6) platform-python-setuptools-39.2.0-7.el8_6.2, python-setuptools-39.2.0-7.el8_6.2, python3-setuptools-39.2.0-7.el8_6.2 +1
- RHSA-2025:11427 Released 2025-07-21 · Red Hat rating Moderatepython-setuptools security update
- Red Hat Enterprise Linux BaseOS E4S (v.8.8) platform-python-setuptools-39.2.0-7.el8_8.3, python-setuptools-39.2.0-7.el8_8.3, python3-setuptools-39.2.0-7.el8_8.3 +1
- Red Hat Enterprise Linux BaseOS TUS (v.8.8) platform-python-setuptools-39.2.0-7.el8_8.3, python-setuptools-39.2.0-7.el8_8.3, python3-setuptools-39.2.0-7.el8_8.3 +1
- RHSA-2025:11425 Released 2025-07-21 · Red Hat rating Moderatepython-setuptools security update
- Red Hat Enterprise Linux BaseOS AUS (v.8.4) platform-python-setuptools-39.2.0-6.el8_4.2, python-setuptools-39.2.0-6.el8_4.2, python3-setuptools-39.2.0-6.el8_4.2 +1
- Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) platform-python-setuptools-39.2.0-6.el8_4.2, python-setuptools-39.2.0-6.el8_4.2, python3-setuptools-39.2.0-6.el8_4.2 +1
- RHSA-2025:11426 Released 2025-07-21 · Red Hat rating Moderatepython-setuptools security update
- Red Hat Enterprise Linux BaseOS AUS (v. 8.2) platform-python-setuptools-39.2.0-5.el8_2.2, python-setuptools-39.2.0-5.el8_2.2, python3-setuptools-39.2.0-5.el8_2.2 +1
- RHSA-2025:11388 Released 2025-07-17 · Red Hat rating ModerateRed Hat OpenShift Builds 1.5.0
- Builds for Red Hat OpenShift 1.5.2 registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel9, registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9
- RHSA-2025:11146 Released 2025-07-15 · Red Hat rating ModerateRed Hat OpenShift Builds 1.4.1
- Builds for Red Hat OpenShift 1.4.1 registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel9, registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9
- RHSA-2025:11102 Released 2025-07-15 · Red Hat rating Moderatefence-agents security update
- Red Hat Enterprise Linux AppStream EUS (v.9.4) fence-agents-4.10.0-62.el9_4.15, fence-agents-common-4.10.0-62.el9_4.15, fence-agents-compute-4.10.0-62.el9_4.15 +11
- Red Hat Enterprise Linux High Availability EUS (v.9.4) fence-agents-aliyun-4.10.0-62.el9_4.15, fence-agents-all-4.10.0-62.el9_4.15, fence-agents-amt-ws-4.10.0-62.el9_4.15 +39
- Red Hat Enterprise Linux Resilient Storage EUS (v.9.4) fence-agents-aliyun-4.10.0-62.el9_4.15, fence-agents-all-4.10.0-62.el9_4.15, fence-agents-amt-ws-4.10.0-62.el9_4.15 +39
- RHSA-2025:11101 Released 2025-07-15 · Red Hat rating Moderatefence-agents security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) fence-agents-4.10.0-43.el9_2.14, fence-agents-common-4.10.0-43.el9_2.14, fence-agents-compute-4.10.0-43.el9_2.14 +11
- Red Hat Enterprise Linux High Availability E4S (v.9.2) fence-agents-aliyun-4.10.0-43.el9_2.14, fence-agents-all-4.10.0-43.el9_2.14, fence-agents-amt-ws-4.10.0-43.el9_2.14 +39
- Red Hat Enterprise Linux Resilient Storage E4S (v.9.2) fence-agents-aliyun-4.10.0-43.el9_2.14, fence-agents-all-4.10.0-43.el9_2.14, fence-agents-amt-ws-4.10.0-43.el9_2.14 +39
- RHSA-2025:11044 Released 2025-07-15 · Red Hat rating Moderatepython3.12-setuptools security update
- Red Hat Enterprise Linux AppStream (v. 8) python3.12-setuptools-68.2.2-5.el8_10
- Red Hat Enterprise Linux CRB (v. 8) python3.12-setuptools-wheel-68.2.2-5.el8_10
- RHSA-2025:11036 Released 2025-07-15 · Red Hat rating Moderatepython-setuptools security update
- Red Hat Enterprise Linux BaseOS (v. 8) platform-python-setuptools-39.2.0-9.el8_10, python-setuptools-39.2.0-9.el8_10, python3-setuptools-39.2.0-9.el8_10 +1
- RHSA-2025:11043 Released 2025-07-15 · Red Hat rating Moderatepython3.11-setuptools security update
- Red Hat Enterprise Linux AppStream (v. 8) python3.11-setuptools-65.5.1-4.el8_10, python3.11-setuptools-wheel-65.5.1-4.el8_10
- RHSA-2025:10992 Released 2025-07-14 · Red Hat rating ImportantRed Hat Developer Hub 1.5.3 release.
- Red Hat Developer Hub 1.5 registry.redhat.io/rhdh/rhdh-hub-rhel9
- RHSA-2025:10809 Released 2025-07-10 · Red Hat rating Moderatesatellite/iop-advisor-engine-rhel9 container image available as a Technology Preview
- Red Hat Satellite 6.17 registry.redhat.io/satellite/iop-advisor-engine-rhel9
- RHSA-2025:10787 Released 2025-07-10 · Red Hat rating ModerateRed Hat OpenShift Builds 1.4.1
- Builds for Red Hat OpenShift 1.4.1 registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel9, registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9
- RHSA-2025:10407 Released 2025-07-07 · Red Hat rating Moderatepython-setuptools security update
- Red Hat Enterprise Linux BaseOS (v. 9) python-setuptools-53.0.0-13.el9_6.1, python3-setuptools-53.0.0-13.el9_6.1, python3-setuptools-wheel-53.0.0-13.el9_6.1
- RHSA-2025:9940 Released 2025-07-01 · Red Hat rating Moderatepython-setuptools security update
- Red Hat Enterprise Linux BaseOS (v. 10) python-setuptools-69.0.3-12.el10_0, python3-setuptools-69.0.3-12.el10_0
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) python3-setuptools-wheel-69.0.3-12.el10_0
- RHSA-2025:9966 Released 2025-06-30 · Red Hat rating ImportantRed Hat Developer Hub 1.6.2 release.
- Red Hat Developer Hub 1.6 registry.redhat.io/rhdh/rhdh-hub-rhel9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Confidential Compute Attestation | Affected | No fix yet |
| Logging Subsystem for Red Hat OpenShift | Affected | No fix planned: Out of support scope |
| OpenShift Lightspeed | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 6 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) | Affected | No fix planned: Will not fix |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix planned: Out of support scope |
| Red Hat Trusted Artifact Signer | Affected | No fix planned: Out of support scope |
| cert-manager Operator for Red Hat OpenShift | Affected | No fix yet |
| Builds for Red Hat OpenShift 1.4.1 | Fixed | RHSA-2025:10787, RHSA-2025:11146 |
| Builds for Red Hat OpenShift 1.5.2 | Fixed | RHSA-2025:11388 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Fixed | RHSA-2025:14686 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Fixed | RHSA-2025:14686 |
| Red Hat CodeReady Linux Builder EUS (v.9.4) | Fixed | RHSA-2025:13668 |
| Red Hat Developer Hub 1.5 | Fixed | RHSA-2025:10992 |
| Red Hat Developer Hub 1.6 | Fixed | RHSA-2025:9966 |
| Red Hat Enterprise Linux AI 1.5 | Fixed | RHSA-2025:19421, RHSA-2025:19422, RHSA-2025:19423, RHSA-2025:19424, RHSA-2025:19425, RHSA-2025:19426, RHSA-2025:19427, RHSA-2025:19428, RHSA-2025:19429, RHSA-2025:19430 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2025:11043, RHSA-2025:11044, RHSA-2025:14900 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2025:11463, RHSA-2025:12834, RHSA-2025:13578 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2025:15411 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2025:15410 |
| Red Hat Enterprise Linux AppStream E4S (v.8.6) | Fixed | RHSA-2025:15410 |
| Red Hat Enterprise Linux AppStream E4S (v.8.8) | Fixed | RHSA-2025:13804, RHSA-2025:15408 |
| Red Hat Enterprise Linux AppStream E4S (v.9.0) | Fixed | RHSA-2025:11464 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2025:11101, RHSA-2025:13803 |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Fixed | RHSA-2025:11102, RHSA-2025:13668, RHSA-2025:13669 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) | Fixed | RHSA-2025:15411 |
| Red Hat Enterprise Linux AppStream TUS (v.8.6) | Fixed | RHSA-2025:15410 |
| Red Hat Enterprise Linux AppStream TUS (v.8.8) | Fixed | RHSA-2025:13804 |
| Red Hat Enterprise Linux BaseOS (v. 10) | Fixed | RHSA-2025:9940 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2025:11036 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2025:10407 |
| Red Hat Enterprise Linux BaseOS AUS (v. 8.2) | Fixed | RHSA-2025:11426 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.4) | Fixed | RHSA-2025:11425 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.6) | Fixed | RHSA-2025:11424 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.6) | Fixed | RHSA-2025:11424 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.8) | Fixed | RHSA-2025:11427 |
| Red Hat Enterprise Linux BaseOS E4S (v.9.0) | Fixed | RHSA-2025:11584 |
| Red Hat Enterprise Linux BaseOS E4S (v.9.2) | Fixed | RHSA-2025:12020 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.4) | Fixed | RHSA-2025:11868 |
| Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) | Fixed | RHSA-2025:11425 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.6) | Fixed | RHSA-2025:11424 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.8) | Fixed | RHSA-2025:11427 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2025:11044, RHSA-2025:14900 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) | Fixed | RHSA-2025:9940 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) | Fixed | RHSA-2025:12834 |
| Red Hat Enterprise Linux High Availability (v. 9) | Fixed | RHSA-2025:11463 |
| Red Hat Enterprise Linux High Availability E4S (v.9.0) | Fixed | RHSA-2025:11464 |
| Red Hat Enterprise Linux High Availability E4S (v.9.2) | Fixed | RHSA-2025:11101 |
| Red Hat Enterprise Linux High Availability EUS (v.9.4) | Fixed | RHSA-2025:11102 |
| Red Hat Enterprise Linux Resilient Storage (v. 9) | Fixed | RHSA-2025:11463 |
| Red Hat Enterprise Linux Resilient Storage E4S (v.9.2) | Fixed | RHSA-2025:11101 |
| Red Hat Enterprise Linux Resilient Storage EUS (v.9.4) | Fixed | RHSA-2025:11102 |
| Red Hat Enterprise Linux ResilientStorage E4S (v.9.0) | Fixed | RHSA-2025:11464 |
| Red Hat Enterprise Linux Server (v. 7 ELS) | Fixed | RHSA-2025:11607, RHSA-2025:11984 |
| Red Hat Quay 3.14 | Fixed | RHSA-2026:4215 |
| Red Hat Satellite 6.17 | Fixed | RHSA-2025:10809 |
Not affected: 15 products
- Builds for Red Hat OpenShift 1.4.1
- Builds for Red Hat OpenShift 1.5.2
- Custom Metric Autoscaler operator for Red Hat Openshift
- Network Observability Operator
- OpenShift Serverless
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Developer Hub 1.5
- Red Hat Developer Hub 1.6
- Red Hat Offline Knowledge Portal
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat Quay 3.14
- Red Hat build of Quarkus Native builder
- Service Telemetry Framework 1.5
Timeline
- 2026-10-02 Threatist record created from CVE-2025-47273
- 2026-10-03 Alias added: GHSA-5rjg-fvgr-3xxf
- 2026-10-16 Affected versions changed · Red Hat
- 2026-10-20 Affected versions changed · Red Hat
- 2026-11-03 Affected versions changed · Red Hat
References
Exploit 2
Other 4
- https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88
- https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2025-49.yaml
- https://github.com/pypa/setuptools
- https://lists.debian.org/debian-lts-announce/2025/05/msg00035.html
More pypa vulnerabilities
- TI-2024-05888 Remote Code Execution in pypa/setuptools CVSS 3.0HIGH 8.8
- TI-2026-78525 Shell command injection in virtualenv generated POSIX launchers CVSS 3.1HIGH 7.8
- TI-2026-78526 Command injection in virtualenv bash activation prompt CVSS 4.0HIGH 7.1
- TI-2026-78521 Code injection in virtualenv Xonsh activation script CVSS 4.0HIGH 7.1
- TI-2026-19377 wheel Allows Arbitrary File Permission Modification via Path Traversal CVSS 3.1HIGH 7.1
- TI-2026-42704 setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+ CVSS 3.1MEDIUM 6.1
Sources
- CVE-2025-47273 · CVE Program
- CVE-2025-47273 · NVD
- FIRST EPSS
- GHSA-5rjg-fvgr-3xxf · GitHub Advisory Database · CC BY 4.0
- CVE-2025-47273 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences