MEDIUM✓ PATCH🇵🇱 Wersja polska

CVE-2022-40897

CVSS 5.9v3.1pub. 2022-12-23upd. 2025-11-04

Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

  • Python Setuptools

    APP
    Python
    < 65.5.1
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
DoS
CWE
References

Related vulnerabilities

CVE-2025-47273HIGH7.7same product

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages....

CVE-2026-59890MEDIUM6.1same product

setuptools to pakiet umożliwiający pobieranie, budowanie, instalowanie, uaktualnianie i odinstalowywanie pakie...

CVE-2013-1633MEDIUM6.8same product

easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not pe...

CVE-2022-48565CRITICAL9.8PL ✓same vendor

XXE w module plistlib języka Python — wykonanie ataku na dane XML

CVE-2022-37454CRITICAL9.8PL ✓same vendor

Integer overflow w implementacji SHA-3 (XKCP) umożliwiający RCE