Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Setuptools | Python | * | 65.5.1 (excluding) |
| Red Hat Enterprise Linux 8 | RedHat | python39:3.9-8100020240214182535.7044f6c1 | * |
| Red Hat Enterprise Linux 8 | RedHat | python39-devel:3.9-8100020240214182535.7044f6c1 | * |
| Red Hat Enterprise Linux 8 | RedHat | python27:2.7-8100020240208011952.5f0f67de | * |
| Red Hat Enterprise Linux 8 | RedHat | python-setuptools-0:39.2.0-6.el8_7.1 | * |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | RedHat | python39:3.9-8060020240916062113.6a631399 | * |
| Red Hat Enterprise Linux 8.6 Extended Update Support | RedHat | python-setuptools-0:39.2.0-7.el8_6 | * |
| Red Hat Enterprise Linux 8.6 Telecommunications Update Service | RedHat | python39:3.9-8060020240916062113.6a631399 | * |
| Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | RedHat | python39:3.9-8060020240916062113.6a631399 | * |
| Red Hat Enterprise Linux 8.8 Extended Update Support | RedHat | python39:3.9-8080020240402104641.93c2fc2f | * |
| Red Hat Enterprise Linux 8.8 Extended Update Support | RedHat | python39-devel:3.9-8080020240402104641.93c2fc2f | * |
| Red Hat Enterprise Linux 9 | RedHat | python-setuptools-0:53.0.0-10.el9_1.1 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-python38-python-setuptools-0:41.6.0-8.el7 | * |
| Python-pip | Ubuntu | bionic | * |
| Python-pip | Ubuntu | esm-apps/xenial | * |
| Python-pip | Ubuntu | focal | * |
| Python-pip | Ubuntu | jammy | * |
| Python-pip | Ubuntu | kinetic | * |
| Python-pip | Ubuntu | trusty | * |
| Python-pip | Ubuntu | trusty/esm | * |
| Python-pip | Ubuntu | upstream | * |
| Python-pip | Ubuntu | xenial | * |
| Python-setuptools | Ubuntu | bionic | * |
| Python-setuptools | Ubuntu | esm-infra/xenial | * |
| Python-setuptools | Ubuntu | focal | * |
| Python-setuptools | Ubuntu | jammy | * |
| Python-setuptools | Ubuntu | kinetic | * |
| Python-setuptools | Ubuntu | trusty | * |
| Python-setuptools | Ubuntu | trusty/esm | * |
| Python-setuptools | Ubuntu | upstream | * |
| Python-setuptools | Ubuntu | xenial | * |
| Setuptools | Ubuntu | focal | * |
| Setuptools | Ubuntu | jammy | * |
| Setuptools | Ubuntu | kinetic | * |
| Setuptools | Ubuntu | upstream | * |
Attackers can create crafted inputs that
intentionally cause the regular expression to use
excessive backtracking in a way that causes the CPU
consumption to spike.