Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/setuptools@34.3.3
Typepypi
Namespace
Namesetuptools
Version34.3.3
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version78.1.1
Latest_non_vulnerable_version78.1.1
Affected_by_vulnerabilities
0
url VCID-1pe7-4f4b-ukhu
vulnerability_id VCID-1pe7-4f4b-ukhu
summary setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue.
references
0
reference_url https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
url https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88
1
reference_url https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
url https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b
2
reference_url https://github.com/pypa/setuptools/issues/4946
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
url https://github.com/pypa/setuptools/issues/4946
3
reference_url https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
url https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf
4
reference_url https://lists.debian.org/debian-lts-announce/2025/05/msg00035.html
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
url https://lists.debian.org/debian-lts-announce/2025/05/msg00035.html
fixed_packages
0
url pkg:pypi/setuptools@78.1.1
purl pkg:pypi/setuptools@78.1.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/setuptools@78.1.1
aliases CVE-2025-47273, GHSA-5rjg-fvgr-3xxf, PYSEC-2025-49
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-1pe7-4f4b-ukhu
1
url VCID-f4x2-qsqp-kfcn
vulnerability_id VCID-f4x2-qsqp-kfcn
summary Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
references
0
reference_url https://github.com/pypa/setuptools/blob/fe8a98e696241487ba6ac9f91faa38ade939ec5d/setuptools/package_index.py#L200
reference_id
reference_type
scores
url https://github.com/pypa/setuptools/blob/fe8a98e696241487ba6ac9f91faa38ade939ec5d/setuptools/package_index.py#L200
1
reference_url https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be
reference_id
reference_type
scores
url https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be
2
reference_url https://github.com/pypa/setuptools/compare/v65.5.0...v65.5.1
reference_id
reference_type
scores
url https://github.com/pypa/setuptools/compare/v65.5.0...v65.5.1
3
reference_url https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/
reference_id
reference_type
scores
url https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/
4
reference_url https://pyup.io/vulnerabilities/CVE-2022-40897/52495/
reference_id
reference_type
scores
url https://pyup.io/vulnerabilities/CVE-2022-40897/52495/
fixed_packages
0
url pkg:pypi/setuptools@65.5.1
purl pkg:pypi/setuptools@65.5.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1pe7-4f4b-ukhu
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/setuptools@65.5.1
aliases CVE-2022-40897, PYSEC-2022-43012
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-f4x2-qsqp-kfcn
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/setuptools@34.3.3