CVE-2024-6345

CVSS V2 None CVSS V3 None

Description

A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.

Overview

CVE ID
CVE-2024-6345

Assigner
@huntr_ai

Vulnerability Status
PUBLISHED

Published Version
2024-07-15T00:00:14.545Z

Last Modified Date
2024-07-15T00:00:14.545Z

Weakness Enumerations

CWE	URL
CWE-94	http://cwe.mitre.org/data/definitions/94.html

References

Reference URL	Reference Tags
https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-6345
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6345

History

Created	Old Value	New Value	Data Type	Notes
2024-07-15 13:03:07				Added to TrackCVE