{"answers":{"affected":"4 open source packages ship an affected version, including setuptools.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-6345 exists.","fix":"Upgrade setuptools to 70.0.0 or later.","what":"CVE-2024-6345 is a high-severity code injection vulnerability in pypa/setuptools, published on 15 Jul 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2024-6345 and fix it if it is affected.\n\nWhat it is: CVE-2024-6345 is a high-severity code injection vulnerability in pypa/setuptools, published on 15 Jul 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-6345 exists.\n\nAffected packages and fixed versions:\n- setuptools (Bitnami): affected all versions; fixed in 70.0.0\n- setuptools (PyPI): affected all versions; fixed in 70.0.0\n- setuptools (PyPI): affected all versions; fixed in 70.0.0\n- setuptools (PyPI): affected all versions; fixed in 70.0.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-6345/ (Markdown: https://insights.sbomify.com/CVE-2024-6345/index.md)","id":"CVE-2024-6345","markdown":"https://insights.sbomify.com/CVE-2024-6345/index.md","name":"CVE-2024-6345","record":{"aliases":["ALPINE-CVE-2024-6345","ALSA-2024:5279","ALSA-2024:5530","ALSA-2024:5531","ALSA-2024:5532","ALSA-2024:5533","ALSA-2024:5534","ALSA-2024:6726","AZL-43326","AZL-43329","AZL-60199","BELL-CVE-2024-6345","BIT-setuptools-2024-6345","CLEANSTART-2026-ZQ12182","CLSA-2024-1730142448","CLSA-2025-1752019950","CLSA-2025-1764615000","CLSA-2026-1787812038","CLSA-2026-1791448913","CLSA-2026-1791449247","DEBIAN-CVE-2024-6345","ECHO-a9d4-b82a-f3c2","GHSA-cx63-2mw6-8hw5","MGASA-2025-0056","MINI-76m2-225f-2gcm","MINI-mmq3-8hq2-q2vw","OESA-2024-1931","PYSEC-2026-1918","RHSA-2024:5000","RHSA-2024:5002","RHSA-2024:5040","RHSA-2024:5078","RHSA-2024:5084","RHSA-2024:5137","RHSA-2024:5279","RHSA-2024:5389","RHSA-2024:5530","RHSA-2024:5531","RHSA-2024:5532","RHSA-2024:5533","RHSA-2024:5534","RHSA-2024:6220","RHSA-2024:6312","RHSA-2024:6488","RHSA-2024:6611","RHSA-2024:6612","RHSA-2024:6661","RHSA-2024:6662","RHSA-2024:6726","RHSA-2024:6907","RHSA-2024:8168","RHSA-2024:8170","RHSA-2024:8171","RHSA-2024:8172","RHSA-2024:8173","RHSA-2024:8179","RLSA-2024:5279","RLSA-2024:5530","RLSA-2024:5531","RLSA-2024:5532","RLSA-2024:5533","RLSA-2024:6726","ROOT-APP-PYPI-CVE-2024-6345","SUSE-SU-2024:2899-1","SUSE-SU-2024:2900-1","SUSE-SU-2024:2904-1","SUSE-SU-2024:2906-1","SUSE-SU-2024:2907-1","SUSE-SU-2024:2950-1","SUSE-SU-2024:3054-1","SUSE-SU-2024:3055-1","SUSE-SU-2025:20053-1","UBUNTU-CVE-2024-6345","USN-7002-1","openSUSE-SU-2024:14294-1"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Python setuptools library","requires_auth":"none","summary":"Remote code execution via code injection in setuptools download functions when exposed to user-controlled inputs.","user_interaction":"required","vuln_class":"code_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"@huntr_ai","cpe":[],"cvss":{"score":8.8,"severity":"high","source":"cna","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"description":"A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.","ecosystems":["AlmaLinux:8","AlmaLinux:9","Bitnami","PyPI","Red Hat:enterprise_linux:8::appstream","Red Hat:enterprise_linux:8::baseos","Red Hat:enterprise_linux:8::crb","Red Hat:enterprise_linux:9::appstream","Red Hat:enterprise_linux:9::baseos","Red Hat:enterprise_linux:9::crb","Red Hat:enterprise_linux:9::highavailability","Red Hat:enterprise_linux:9::resilientstorage","Red Hat:rhel_aus:8.2::baseos","Red Hat:rhel_aus:8.4::appstream","Red Hat:rhel_aus:8.4::baseos","Red Hat:rhel_aus:8.4::highavailability","Red Hat:rhel_aus:8.6::appstream","Red Hat:rhel_aus:8.6::baseos","Red Hat:rhel_e4s:8.4::appstream","Red Hat:rhel_e4s:8.4::baseos","Red Hat:rhel_e4s:8.4::highavailability","Red Hat:rhel_e4s:8.6::appstream","Red Hat:rhel_e4s:8.6::baseos","Red Hat:rhel_e4s:8.6::highavailability","Red Hat:rhel_e4s:9.0::appstream","Red Hat:rhel_e4s:9.0::baseos","Red Hat:rhel_e4s:9.0::highavailability","Red Hat:rhel_e4s:9.0::resilientstorage","Red Hat:rhel_els:7","Red Hat:rhel_eus:8.8::appstream","Red Hat:rhel_eus:8.8::baseos","Red Hat:rhel_eus:8.8::crb","Red Hat:rhel_eus:8.8::highavailability","Red Hat:rhel_eus:8.8::resilientstorage","Red Hat:rhel_eus:9.2::appstream","Red Hat:rhel_eus:9.2::baseos","Red Hat:rhel_eus:9.2::highavailability","Red Hat:rhel_eus:9.2::resilientstorage","Red Hat:rhel_tus:8.4::appstream","Red Hat:rhel_tus:8.4::baseos","Red Hat:rhel_tus:8.4::highavailability","Red Hat:rhel_tus:8.6::appstream","Red Hat:rhel_tus:8.6::baseos","Red Hat:rhel_tus:8.6::highavailability","Rocky Linux:8","Rocky Linux:9","SUSE:Enterprise Storage 7.1","SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","SUSE:Linux Enterprise Micro 5.1","SUSE:Linux Enterprise Micro 5.2","SUSE:Linux Enterprise Micro 5.3","SUSE:Linux Enterprise Micro 5.4","SUSE:Linux Enterprise Micro 5.5","SUSE:Linux Enterprise Module for Basesystem 15 SP5","SUSE:Linux Enterprise Module for Basesystem 15 SP6","SUSE:Linux Enterprise Module for Containers 12","SUSE:Linux Enterprise Module for Public Cloud 12","SUSE:Linux Enterprise Module for Public Cloud 15 SP4","SUSE:Linux Enterprise Module for Python 3 15 SP5","SUSE:Linux Enterprise Module for Python 3 15 SP6","SUSE:Linux Enterprise Server 12 SP5","SUSE:Linux Enterprise Server 15 SP2-LTSS","SUSE:Linux Enterprise Server 15 SP3-LTSS","SUSE:Linux Enterprise Server 15 SP4-LTSS","SUSE:Linux Enterprise Server for SAP Applications 12 SP5","SUSE:Linux Enterprise Server for SAP Applications 15 SP2","SUSE:Linux Enterprise Server for SAP Applications 15 SP3","SUSE:Linux Enterprise Server for SAP Applications 15 SP4","SUSE:Linux Enterprise Software Development Kit 12 SP5","SUSE:Linux Micro 6.0","SUSE:Manager Proxy 4.3","SUSE:Manager Server 4.3","openSUSE:Leap 15.5","openSUSE:Leap 15.6","openSUSE:Leap Micro 5.5","openSUSE:Tumbleweed"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Remote Code Execution in pypa/setuptools","id":"CVE-2024-6345","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Bitnami","product":null,"products":[],"type":"code_injection","year":"2024"},"n_packages":1627,"n_references":2,"next":{"headline":"Cross-site scripting in Post Grid","id":"CVE-2024-6346"},"packages":[{"ecosystem":"Bitnami","fixed":["70.0.0"],"introduced":["0"],"last_affected":[],"package":"setuptools","purl":"pkg:bitnami/setuptools","source":"BIT-setuptools-2024-6345"},{"ecosystem":"PyPI","fixed":["70.0.0"],"introduced":["0"],"last_affected":[],"package":"setuptools","purl":null,"source":"GHSA-cx63-2mw6-8hw5"},{"ecosystem":"PyPI","fixed":["70.0.0"],"introduced":["0"],"last_affected":[],"package":"setuptools","purl":"pkg:pypi/setuptools","source":"GHSA-cx63-2mw6-8hw5"},{"ecosystem":"PyPI","fixed":["70.0.0"],"introduced":["0"],"last_affected":[],"package":"setuptools","purl":"pkg:pypi/setuptools","source":"PYSEC-2026-1918"},{"ecosystem":"AlmaLinux:8","fixed":["39.2.0-8.el8_10"],"introduced":["0"],"last_affected":[],"package":"platform-python-setuptools","purl":"pkg:rpm/almalinux/platform-python-setuptools","source":"ALSA-2024:5530"},{"ecosystem":"AlmaLinux:8","fixed":["39.2.0-8.el8_10"],"introduced":["0"],"last_affected":[],"package":"python3-setuptools","purl":"pkg:rpm/almalinux/python3-setuptools","source":"ALSA-2024:5530"},{"ecosystem":"AlmaLinux:8","fixed":["39.2.0-8.el8_10"],"introduced":["0"],"last_affected":[],"package":"python3-setuptools-wheel","purl":"pkg:rpm/almalinux/python3-setuptools-wheel","source":"ALSA-2024:5530"},{"ecosystem":"AlmaLinux:8","fixed":["65.5.1-3.el8_10"],"introduced":["0"],"last_affected":[],"package":"python3.11-setuptools","purl":"pkg:rpm/almalinux/python3.11-setuptools","source":"ALSA-2024:5532"},{"ecosystem":"AlmaLinux:8","fixed":["65.5.1-3.el8_10"],"introduced":["0"],"last_affected":[],"package":"python3.11-setuptools-wheel","purl":"pkg:rpm/almalinux/python3.11-setuptools-wheel","source":"ALSA-2024:5532"},{"ecosystem":"AlmaLinux:8","fixed":["68.2.2-4.el8_10"],"introduced":["0"],"last_affected":[],"package":"python3.12-setuptools","purl":"pkg:rpm/almalinux/python3.12-setuptools","source":"ALSA-2024:5531"},{"ecosystem":"AlmaLinux:8","fixed":["68.2.2-4.el8_10"],"introduced":["0"],"last_affected":[],"package":"python3.12-setuptools-wheel","purl":"pkg:rpm/almalinux/python3.12-setuptools-wheel","source":"ALSA-2024:5531"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-aliyun","purl":"pkg:rpm/almalinux/fence-agents-aliyun","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-all","purl":"pkg:rpm/almalinux/fence-agents-all","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-amt-ws","purl":"pkg:rpm/almalinux/fence-agents-amt-ws","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-apc","purl":"pkg:rpm/almalinux/fence-agents-apc","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-apc-snmp","purl":"pkg:rpm/almalinux/fence-agents-apc-snmp","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-aws","purl":"pkg:rpm/almalinux/fence-agents-aws","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-azure-arm","purl":"pkg:rpm/almalinux/fence-agents-azure-arm","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-bladecenter","purl":"pkg:rpm/almalinux/fence-agents-bladecenter","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-brocade","purl":"pkg:rpm/almalinux/fence-agents-brocade","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-cisco-mds","purl":"pkg:rpm/almalinux/fence-agents-cisco-mds","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-cisco-ucs","purl":"pkg:rpm/almalinux/fence-agents-cisco-ucs","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-common","purl":"pkg:rpm/almalinux/fence-agents-common","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-compute","purl":"pkg:rpm/almalinux/fence-agents-compute","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-drac5","purl":"pkg:rpm/almalinux/fence-agents-drac5","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-eaton-snmp","purl":"pkg:rpm/almalinux/fence-agents-eaton-snmp","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-emerson","purl":"pkg:rpm/almalinux/fence-agents-emerson","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-eps","purl":"pkg:rpm/almalinux/fence-agents-eps","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-gce","purl":"pkg:rpm/almalinux/fence-agents-gce","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-heuristics-ping","purl":"pkg:rpm/almalinux/fence-agents-heuristics-ping","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-hpblade","purl":"pkg:rpm/almalinux/fence-agents-hpblade","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-ibm-powervs","purl":"pkg:rpm/almalinux/fence-agents-ibm-powervs","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-ibm-vpc","purl":"pkg:rpm/almalinux/fence-agents-ibm-vpc","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-ibmblade","purl":"pkg:rpm/almalinux/fence-agents-ibmblade","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-ifmib","purl":"pkg:rpm/almalinux/fence-agents-ifmib","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-ilo-moonshot","purl":"pkg:rpm/almalinux/fence-agents-ilo-moonshot","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-ilo-mp","purl":"pkg:rpm/almalinux/fence-agents-ilo-mp","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-ilo-ssh","purl":"pkg:rpm/almalinux/fence-agents-ilo-ssh","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-ilo2","purl":"pkg:rpm/almalinux/fence-agents-ilo2","source":"ALSA-2024:6726"},{"ecosystem":"AlmaLinux:9","fixed":["4.10.0-62.el9_4.5"],"introduced":["0"],"last_affected":[],"package":"fence-agents-intelmodular","purl":"pkg:rpm/almalinux/fence-agents-intelmodular","source":"ALSA-2024:6726"}],"prev":{"headline":"ZKTeco ZKBio CVSecurity V5000 Push Configuration Section cross site scripting","id":"CVE-2024-6344"},"products":["pypa/setuptools"],"published":"2024-07-15","related":[],"sources":[{"class":"attribution","licence":"MIT","name":"AlmaLinux","prefix":"ALSA"},{"class":"attribution","licence":"Apache-2.0","name":"Bitnami","prefix":"BIT"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-11-04","vendors":["pypa"]},"summary":"Remote code execution via code injection in setuptools download functions when exposed to user-controlled inputs.","url":"https://insights.sbomify.com/CVE-2024-6345/"}