CVE-2024-6345 Remote Code Execution in pypa/setuptools
Remote code execution via code injection in setuptools download functions when exposed to user-controlled inputs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-6345?
CVE-2024-6345 is a high-severity code injection vulnerability in pypa/setuptools, published on 15 Jul 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.
Weakness: CWE-94
Which versions are affected by CVE-2024-6345?
4 open source packages ship an affected version, including setuptools.
| Package | Affected | Fixed in |
|---|---|---|
setuptools Bitnami | All versions | 70.0.0 |
setuptools PyPI | All versions | 70.0.0 |
setuptools PyPI | All versions | 70.0.0 |
setuptools PyPI | All versions | 70.0.0 |
Linux distribution packages (36)
platform-python-setuptools AlmaLinux:8 | All versions | 39.2.0-8.el8_10 |
python3-setuptools AlmaLinux:8 | All versions | 39.2.0-8.el8_10 |
python3-setuptools-wheel AlmaLinux:8 | All versions | 39.2.0-8.el8_10 |
python3.11-setuptools AlmaLinux:8 | All versions | 65.5.1-3.el8_10 |
python3.11-setuptools-wheel AlmaLinux:8 | All versions | 65.5.1-3.el8_10 |
python3.12-setuptools AlmaLinux:8 | All versions | 68.2.2-4.el8_10 |
python3.12-setuptools-wheel AlmaLinux:8 | All versions | 68.2.2-4.el8_10 |
fence-agents-aliyun AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-all AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-amt-ws AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-apc AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-apc-snmp AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-aws AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-azure-arm AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-bladecenter AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-brocade AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-cisco-mds AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-cisco-ucs AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-common AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-compute AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-drac5 AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-eaton-snmp AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-emerson AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-eps AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-gce AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-heuristics-ping AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-hpblade AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-ibm-powervs AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-ibm-vpc AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-ibmblade AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-ifmib AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-ilo-moonshot AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-ilo-mp AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-ilo-ssh AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-ilo2 AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
fence-agents-intelmodular AlmaLinux:9 | All versions | 4.10.0-62.el9_4.5 |
How do I fix CVE-2024-6345?
Upgrade setuptools to 70.0.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-6345 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-6345 exists.
Sources
Also known as ALPINE-CVE-2024-6345, ALSA-2024:5279, ALSA-2024:5530, ALSA-2024:5531, ALSA-2024:5532, ALSA-2024:5533 and 69 more.