Skip to content
Fencer Vulns
medium 5.9

CVE-2022-40897 json

pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS)

published 2022-12-22 3 y ago modified 2026-09-08 2 mo ago also BIT-setuptools-2022-40897 , EUVD-2022-0278 , GHSA-r9hx-vwmv-q579 , PYSEC-2022-43012

cvss
5.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.6%
EPSS 2.6% chance of exploitation in 30 days, percentile 85%
public exploits
0
none known

Summary

Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.

Patch / fix

  • pypi setuptools 65.5.1
  • bitnami setuptools 65.5.1
  • python setuptools 65.5.1
  • setuptools Debian 14, Debian 13, Debian 12 65.6.3-1

debian advisories DEBIAN-CVE-2022-40897

  • python-pip Ubuntu 18.04 LTS 9.0.1-2.3~ubuntu1.18.04.6
  • python-pip Ubuntu 20.04 LTS 20.0.2-5ubuntu1.7
  • python-pip Ubuntu 22.04 LTS 22.0.2+dfsg-1ubuntu0.1
  • setuptools Ubuntu 20.04 LTS 45.2.0-1ubuntu0.1
  • setuptools Ubuntu 22.04 LTS 59.6.0-1.2ubuntu0.22.04.1
  • python-setuptools Ubuntu 18.04 LTS 39.0.1-2ubuntu0.1
  • python-setuptools Ubuntu 20.04 LTS 44.0.0-2ubuntu0.1
  • python-setuptools Ubuntu 22.04 LTS 44.1.1-1.2ubuntu0.22.04.1

ubuntu advisories UBUNTU-CVE-2022-40897

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • pytz RHEL 8 2017.2-13.module+el8.9.0+19487+7dc18407
  • babel RHEL 8 2.5.1-10.module+el8.9.0+19487+7dc18407
  • numpy RHEL 8 1:1.14.2-16.module+el8.9.0+19487+7dc18407
  • scipy RHEL 8 1.0.0-22.module+el8.9.0+19487+7dc18407
  • Cython RHEL 8 0.28.1-7.module+el8.9.0+19487+7dc18407
  • pytest RHEL 8 3.4.2-13.module+el8.9.0+19487+7dc18407
  • PyYAML RHEL 8 3.12-16.module+el8.9.0+19487+7dc18407
  • python2 RHEL 8 2.7.18-17.module+el8.10.0+20822+a15ec22d

red hat advisories RHSA-2024:6915RHSA-2024:4421RHSA-2024:2987RHSA-2024:2985RHSA-2023:7395RHSA-2023:6793

  • python3-setuptools SLE Module for Basesystem 15 SP5, SLE Module for Basesystem 15 SP4, SLE Micro 5.5 +6 more 44.1.1-150400.9.6.1
  • python3-setuptools-test SLE Module for Basesystem 15 SP5, SLE Module for Basesystem 15 SP4, openSUSE Leap 15.5 +1 more 44.1.1-150400.9.6.1
  • python3-setuptools-wheel SLE Module for Basesystem 15 SP5, SLE Module for Basesystem 15 SP4, openSUSE Leap 15.5 +1 more 44.1.1-150400.9.6.1
  • python-setuptools OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 36.5.0-3.3.1
  • python-setuptools OpenStack Cloud Crowbar 9, OpenStack Cloud 9 40.1.0-3.3.1
  • python-setuptools SLE Real Time 15 SP3, SLE Micro 5.2, SLE Micro 5.1 +1 more 40.5.0-150100.6.6.1
  • python-setuptools-test SLE Real Time 15 SP3 40.5.0-150100.6.6.1
  • python-setuptools-wheel SLE Real Time 15 SP3 40.5.0-150100.6.6.1

suse advisories SUSE-SU-2024:2435-1SUSE-SU-2023:4517-1SUSE-SU-2023:0403-1SUSE-SU-2023:0402-1SUSE-SU-2023:0223-1SUSE-SU-2023:0202-1

  • python39 AlmaLinux 8 3.9.18-3.module_el8.10.0+3765+2f9a457d
  • python39-py AlmaLinux 8 1.10.0-1.module_el8.6.0+2780+a40f65e1
  • python39-pip AlmaLinux 8 20.2.4-9.module_el8.10.0+3765+2f9a457d
  • python39-ply AlmaLinux 8 3.11-10.module_el8.6.0+2780+a40f65e1
  • python39-six AlmaLinux 8 1.15.0-3.module_el8.6.0+2780+a40f65e1
  • python39-cffi AlmaLinux 8 1.14.3-2.module_el8.6.0+2780+a40f65e1
  • python39-cffi AlmaLinux 8 1.14.3-2.module_el8.6.0+3248+c431e88c
  • python39-idle AlmaLinux 8 3.9.18-3.module_el8.10.0+3765+2f9a457d

almalinux advisories ALSA-2024:2985ALSA-2024:2987ALSA-2023:0952ALSA-2023:0835

  • pytz Rocky Linux 8 2017.2-13.module+el8.10.0+1817+0b01df83
  • babel Rocky Linux 8 2.5.1-10.module+el8.9.0+1531+a18208f5
  • numpy Rocky Linux 8 1:1.14.2-16.module+el8.9.0+1531+a18208f5
  • scipy Rocky Linux 8 1.0.0-22.module+el8.10.0+1817+0b01df83
  • Cython Rocky Linux 8 0.28.1-7.module+el8.9.0+1531+a18208f5
  • pytest Rocky Linux 8 3.4.2-13.module+el8.9.0+1531+a18208f5
  • PyYAML Rocky Linux 8 3.12-16.module+el8.9.0+1531+a18208f5
  • python2 Rocky Linux 8 2.7.18-17.module+el8.10.0+1813+4b021305.rocky.0.2

rocky linux advisories RLSA-2024:2987RLSA-2024:2985RLSA-2023:0952RLSA-2023:0835

  • python3 CBL-Mariner 2.0 3.9.19-11

azure linux advisories AZL-60207

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-40897 updated cvss 5.9

pypa-setuptools: Regular Expression Denial of Service (ReDoS) in package_index.py

  • Red Hat Enterprise Linux 6 python-setuptools Red Hat Enterprise Linux 7 python-setuptools, python3-setuptools
    affected: no fix planned “Out of support scope”
  • Red Hat OpenStack Platform 16.1 python-setuptools
    affected: no fix planned “Will not fix”
  • Red Hat Quay 3 python-setuptools
    affected: no fix available
  • Red Hat Service Telemetry Framework 1.3 for RHEL 8 python-setuptools
    affected: no fix planned “Out of support scope”
  • Red Hat Service Telemetry Framework 1.4 for RHEL 8 python-setuptools
    affected: no fix planned “Will not fix”
  • Red Hat CodeReady Linux Builder EUS (v.8.8) pytest 6.0.2-2.module+el8.4.0+9822+20bf1249, Cython 0.29.21-5.module+el8.4.0+9822+20bf1249, pybind11 2.7.1-1.module+el8.6.0+12838+640e6226, python-py 1.10.0-1.module+el8.4.0+9822+20bf1249, python39-py 1.10.0-1.module+el8.4.0+9822+20bf1249, python-attrs 20.3.0-2.module+el8.4.0+9822+20bf1249, +16 more
    fixed: vendor fix RHSA-2024:4421
  • Red Hat Enterprise Linux AppStream (v. 8) scipy 1.5.4-5.module+el8.9.0+19644+d68f775d, babel 2.5.1-10.module+el8.9.0+19487+7dc18407, numpy 1.19.4-3.module+el8.9.0+19644+d68f775d, pytz 2017.2-13.module+el8.9.0+19487+7dc18407, PyYAML 3.12-16.module+el8.9.0+19487+7dc18407, PyYAML 5.4.1-1.module+el8.9.0+19644+d68f775d, +138 more
    fixed: vendor fix RHSA-2024:2987
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) scipy 1.5.4-3.module+el8.4.0+9822+20bf1249, numpy 1.19.4-3.module+el8.5.0+12204+54860423, PyYAML 5.4.1-1.module+el8.5.0+10613+59a13ec4, mod_wsgi 4.7.1-4.module+el8.4.0+9822+20bf1249, python-idna 2.10-3.module+el8.4.0+9822+20bf1249, python-ply 3.11-10.module+el8.4.0+9822+20bf1249, +49 more Red Hat Enterprise Linux AppStream E4S (v.8.6) scipy 1.5.4-3.module+el8.4.0+9822+20bf1249, numpy 1.19.4-3.module+el8.5.0+12204+54860423, PyYAML 5.4.1-1.module+el8.5.0+10613+59a13ec4, mod_wsgi 4.7.1-4.module+el8.4.0+9822+20bf1249, python-idna 2.10-3.module+el8.4.0+9822+20bf1249, python-ply 3.11-10.module+el8.4.0+9822+20bf1249, +49 more
    fixed: vendor fix RHSA-2024:6915
show 8 more
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) scipy 1.5.4-3.module+el8.4.0+9822+20bf1249, numpy 1.19.4-3.module+el8.5.0+12204+54860423, PyYAML 5.4.1-1.module+el8.5.0+10613+59a13ec4, mod_wsgi 4.7.1-5.module+el8.7.0+16654+645aad7f, python-idna 2.10-3.module+el8.4.0+9822+20bf1249, python-ply 3.11-10.module+el8.4.0+9822+20bf1249, +49 more
    fixed: vendor fix RHSA-2024:4421
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) scipy 1.5.4-3.module+el8.4.0+9822+20bf1249, numpy 1.19.4-3.module+el8.5.0+12204+54860423, PyYAML 5.4.1-1.module+el8.5.0+10613+59a13ec4, mod_wsgi 4.7.1-4.module+el8.4.0+9822+20bf1249, python-idna 2.10-3.module+el8.4.0+9822+20bf1249, python-ply 3.11-10.module+el8.4.0+9822+20bf1249, +49 more
    fixed: vendor fix RHSA-2024:6915
  • Red Hat Enterprise Linux BaseOS (v. 8) python-setuptools 39.2.0-6.el8_7.1, python3-setuptools 39.2.0-6.el8_7.1, python3-setuptools-wheel 39.2.0-6.el8_7.1, platform-python-setuptools 39.2.0-6.el8_7.1
    fixed: vendor fix RHSA-2023:0835
  • Red Hat Enterprise Linux BaseOS (v. 9) python-setuptools 53.0.0-10.el9_1.1, python3-setuptools 53.0.0-10.el9_1.1, python3-setuptools-wheel 53.0.0-10.el9_1.1
    fixed: vendor fix RHSA-2023:0952
  • Red Hat Enterprise Linux BaseOS EUS (v.8.6) python-setuptools 39.2.0-7.el8_6, python3-setuptools 39.2.0-7.el8_6, python3-setuptools-wheel 39.2.0-7.el8_6, platform-python-setuptools 39.2.0-7.el8_6
    fixed: vendor fix RHSA-2023:7395
  • Red Hat Enterprise Linux CRB (v. 8) pytest 6.0.2-2.module+el8.9.0+19644+d68f775d, Cython 0.29.21-5.module+el8.9.0+19644+d68f775d, pybind11 2.7.1-1.module+el8.9.0+19644+d68f775d, python-py 1.10.0-1.module+el8.9.0+19644+d68f775d, python39-py 1.10.0-1.module+el8.9.0+19644+d68f775d, python-attrs 20.3.0-2.module+el8.9.0+19644+d68f775d, +16 more
    fixed: vendor fix RHSA-2024:2985
  • Red Hat Software Collections for RHEL Workstation(v. 7) rh-python38-python-setuptools 41.6.0-8.el7, rh-python38-python-setuptools-wheel 41.6.0-8.el7 Red Hat Software Collections for RHEL(v. 7) rh-python38-python-setuptools 41.6.0-8.el7, rh-python38-python-setuptools-wheel 41.6.0-8.el7
    fixed: vendor fix RHSA-2023:6793
  • Red Hat Ansible Automation Platform 2 python-setuptools Red Hat Enterprise Linux 8 python3.11-setuptools, python3.11-setuptools-wheel Red Hat Enterprise Linux 9 python3.11-setuptools, python3.11-setuptools-wheel Red Hat OpenShift Container Platform 4 python-setuptools Red Hat OpenShift Dev Spaces python-setuptools Red Hat Satellite 6 python-setuptools
    +3 more products
    Red Hat Software Collections for RHEL Workstation(v. 7) rh-python38-python 3.8.18-2.el7, rh-python38-python-pip 19.3.1-4.el7, rh-python38-python-idle 3.8.18-2.el7, rh-python38-python-libs 3.8.18-2.el7, rh-python38-python-test 3.8.18-2.el7, rh-python38-python-wheel 0.33.6-9.el7, +7 more Red Hat Software Collections for RHEL(v. 7) rh-python38-python 3.8.18-2.el7, rh-python38-python-pip 19.3.1-4.el7, rh-python38-python-idle 3.8.18-2.el7, rh-python38-python-libs 3.8.18-2.el7, rh-python38-python-test 3.8.18-2.el7, rh-python38-python-wheel 0.33.6-9.el7, +7 more Red Hat Update Infrastructure 4 for Cloud Providers python-setuptools
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

2.63% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • pyup.io https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
pypi setuptools
<65.5.1
65.5.1
bitnami setuptools
<65.5.1
65.5.1

Classification

Weakness
  • CWE-1333 Inefficient Regular Expression Complexity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.