CVE-2024-6345 json
Remote Code Execution in pypa/setuptools
published 2024-07-15 2 y ago modified 2026-09-10 1 mo ago also BIT-setuptools-2024-6345 , EUVD-2024-2330 , GHSA-cx63-2mw6-8hw5 , PYSEC-2026-1918
- cvss
- 8.8
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.9%
- EPSS 1.9% chance of exploitation in 30 days, percentile 80%
- public exploits
- 0
- none known
Summary
A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.
Patch / fix
- pypi setuptools 70.0.0
- bitnami setuptools 70.0.0
- pypa pypa/setuptools 70.0
- python setuptools 70.0
- setuptools Debian 12 66.1.1-1+deb12u1
- setuptools Debian 14, Debian 13 70.3.0-2
debian advisories DEBIAN-CVE-2024-6345
- setuptools Ubuntu 20.04 LTS 45.2.0-1ubuntu0.2
- setuptools Ubuntu 22.04 LTS 59.6.0-1.2ubuntu0.22.04.2
- setuptools Ubuntu 24.04 LTS 68.1.2-2ubuntu1.1
- python-pip Ubuntu Pro 14.04 LTS 1.5.4-1ubuntu4+esm5
- python-pip Ubuntu Pro 16.04 LTS 8.1.1-2ubuntu0.6+esm8
- python-pip Ubuntu Pro 18.04 LTS 9.0.1-2.3~ubuntu1.18.04.8+esm4
- python-pip Ubuntu Pro 20.04 LTS 20.0.2-5ubuntu1.10+esm2
- python-setuptools Ubuntu Pro 14.04 LTS 3.3-1ubuntu2+esm2
ubuntu advisories UBUNTU-CVE-2024-6345
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- numpy RHEL 8 1.19.4-3.module+el8.9.0+19644+d68f775d
- scipy RHEL 8 1.5.4-5.module+el8.9.0+19644+d68f775d
- Cython RHEL 8 0.29.21-5.module+el8.9.0+19644+d68f775d
- pytest RHEL 8 6.0.2-2.module+el8.9.0+19644+d68f775d
- PyYAML RHEL 8 5.4.1-1.module+el8.9.0+19644+d68f775d
- mod_wsgi RHEL 8 4.7.1-7.module+el8.9.0+19644+d68f775d
- pybind11 RHEL 8 2.7.1-1.module+el8.9.0+19644+d68f775d
- python39 RHEL 8 3.9.19-7.module+el8.10.0+22237+51382d7a
red hat advisories RHSA-2024:6488RHSA-2024:6220RHSA-2024:5962RHSA-2024:5084RHSA-2024:8168RHSA-2024:8179
- python-setuptools Linux Micro 6.0 69.0.2-2.1
- venv-salt-minion Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS, EL-9:Update:Products:SaltBundle:Update 3006.0-1.47.1
- saltbundlepy EL-9:Update:Products:SaltBundle:Update 3.11.9-1.26.1
- saltbundlepy-core EL-9:Update:Products:SaltBundle:Update 3.11.9-1.26.1
- saltbundlepy-idna EL-9:Update:Products:SaltBundle:Update 3.4-1.9.2
- saltbundlepy-zipp EL-9:Update:Products:SaltBundle:Update 3.15.0-1.9.2
- saltbundlepy-docker EL-9:Update:Products:SaltBundle:Update 7.0.0-1.8.1
- saltbundlepy-passlib EL-9:Update:Products:SaltBundle:Update 1.7.4-1.3.1
suse advisories SUSE-SU-2025:20053-1SUSE-EL-9-CLIENT-TOOLS-2024-4029SUSE-SU-2024:4029-1SUSE-SU-2024:4021-1SUSE-SU-2024:4020-1SUSE-SU-2024:3055-1
- python-setuptools openSUSE Tumbleweed 72.1.0-1.1
opensuse advisories openSUSE-SU-2024:14294-1
- fence-virt AlmaLinux 9 4.10.0-62.el9_4.5
- fence-virtd AlmaLinux 9 4.10.0-62.el9_4.5
- fence-virtd-cpg AlmaLinux 9 4.10.0-62.el9_4.5
- fence-virtd-tcp AlmaLinux 9 4.10.0-62.el9_4.5
- fence-agents-all AlmaLinux 9 4.10.0-62.el9_4.5
- fence-agents-apc AlmaLinux 9 4.10.0-62.el9_4.5
- fence-agents-aws AlmaLinux 9 4.10.0-62.el9_4.5
- fence-agents-eps AlmaLinux 9 4.10.0-62.el9_4.5
almalinux advisories ALSA-2024:6726ALSA-2024:6309ALSA-2024:6311ALSA-2024:5962ALSA-2024:5530ALSA-2024:5531
- resource-agents Rocky Linux 8 4.9.0-54.el8_10.4
- numpy Rocky Linux 8 1.19.4-3.module+el8.10.0+1582+bc278001
- numpy Rocky Linux 8 1.19.4-3.module+el8.10.0+1860+afcc1c71
- scipy Rocky Linux 8 1.5.4-5.module+el8.10.0+1582+bc278001
- scipy Rocky Linux 8 1.5.4-5.module+el8.10.0+1860+afcc1c71
- Cython Rocky Linux 8 0.29.21-5.module+el8.10.0+1860+afcc1c71
- Cython Rocky Linux 8 0.29.21-5.module+el8.10.0+1582+bc278001
- pytest Rocky Linux 8 6.0.2-2.module+el8.10.0+1582+bc278001
rocky linux advisories RLSA-2024:6311RLSA-2024:5962RLSA-2024:6309RLSA-2024:6726RLSA-2024:5279RLSA-2024:5533
- py3-setuptools Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 70.3.0-r0
alpine advisories ALPINE-CVE-2024-6345
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- python-pip Azure Linux 3.0 24.2-1
- python-setuptools Azure Linux 3.0 69.0.3-4
- python3 CBL-Mariner 2.0 3.9.19-12
azure linux advisories AZL-43326AZL-43329AZL-60199
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
- github.com/pypa/setuptools@88807c7 commit
- github.com/pypa/setuptools#4332 pull request
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2024-6345 updated cvss 8.8
pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools
-
Red Hat Multiarch Tuning Operator multiarch-tuning-rhel9-operator Red Hat Ansible Automation Platform 2 automation-controller, ansible-automation-platform-25/ee-minimal-rhel8, ansible-automation-platform-24/ee-supported-rhel9, ansible-automation-platform-24/ansible-builder-rhel9, ansible-automation-platform-25/ee-cloud-services-rhel9, ansible-automation-platform-24/ee-dellemc-openmanage-rhel8, +1 more Red Hat Ceph Storage 7 rhceph/ceph-nvmeof-rhel9, rhceph/ceph-nvmeof-cli-rhel9affected: workaround, no fix available
-
Red Hat Enterprise Linux 6 python-setuptoolsaffected: workaround, no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 8 python2-setuptools, python2-setuptools-wheelaffected: workaround, no fix planned “Will not fix”
-
Red Hat Enterprise Linux 9 rhel-bootc, bootc-image-builder Red Hat OpenShift AI (RHOAI) odh-ml-pipelines-cache-container, odh-ml-pipelines-scheduledworkflow-container Red Hat OpenShift Container Platform 4 openshift4/ztp-site-generate-rhel8 Red Hat OpenShift Data Science (RHODS) rhods/odh-ml-pipelines-cache-rhel8, rhods/odh-ml-pipelines-api-server-rhel8, rhods/odh-ml-pipelines-artifact-manager-rhel8affected: workaround, no fix available
-
Red Hat Quay v3 quay/quay-rhel8 v3.11.4-7, quay/clair-rhel8 v3.11.4-1, quay/clair-rhel8 v3.12.1-1, quay/quay-rhel8 v3.12.1-11, quay/quay-builder-rhel8 v3.11.4-1, quay/quay-builder-rhel8 v3.12.1-1, +14 morefixed: vendor fix RHBA-2024:5039
-
Red Hat Ceph Storage 7.1 rhceph/rhceph-7-rhel9 1781863705fixed: vendor fix RHSA-2026:33154
-
Red Hat CodeReady Linux Builder EUS (v.8.8) pytest 6.0.2-2.module+el8.4.0+9822+20bf1249, Cython 0.29.21-5.module+el8.4.0+9822+20bf1249, pybind11 2.7.1-1.module+el8.6.0+12838+640e6226, python-py 1.10.0-1.module+el8.4.0+9822+20bf1249, python39-py 1.10.0-1.module+el8.4.0+9822+20bf1249, python-attrs 20.3.0-2.module+el8.4.0+9822+20bf1249, +16 morefixed: vendor fix RHSA-2024:5084
-
Red Hat Developer Hub 1.2 for RHEL 9 rhdh/rhdh-hub-rhel9 1.2-105fixed: vendor fix RHEA-2024:4071
show 27 moreshow fewer
-
Red Hat Enterprise Linux AppStream (v. 8) fence-agents 4.2.1-129.el8_10.4, fence-agents-all 4.2.1-129.el8_10.4, fence-agents-apc 4.2.1-129.el8_10.4, fence-agents-eps 4.2.1-129.el8_10.4, fence-agents-rsa 4.2.1-129.el8_10.4, fence-agents-rsb 4.2.1-129.el8_10.4, +95 morefixed: vendor fix RHSA-2024:5962
-
Red Hat Enterprise Linux AppStream (v. 9) fence-virt 4.10.0-62.el9_4.5, fence-virtd 4.10.0-62.el9_4.5, fence-agents 4.10.0-62.el9_4.5, fence-virtd-cpg 4.10.0-62.el9_4.5, fence-virtd-tcp 4.10.0-62.el9_4.5, fence-agents-virsh 4.10.0-62.el9_4.5, +11 morefixed: vendor fix RHSA-2024:6726
-
Red Hat Enterprise Linux AppStream AUS (v.8.4) fence-agents 4.2.1-65.el8_4.20, fence-agents-all 4.2.1-65.el8_4.20, fence-agents-apc 4.2.1-65.el8_4.20, fence-agents-eps 4.2.1-65.el8_4.20, fence-agents-rsa 4.2.1-65.el8_4.20, fence-agents-rsb 4.2.1-65.el8_4.20, +91 morefixed: vendor fix RHSA-2024:6488
-
Red Hat Enterprise Linux AppStream AUS (v.8.6) fence-agents 4.2.1-89.el8_6.14, fence-agents-all 4.2.1-89.el8_6.14, fence-agents-apc 4.2.1-89.el8_6.14, fence-agents-eps 4.2.1-89.el8_6.14, fence-agents-rsa 4.2.1-89.el8_6.14, fence-agents-rsb 4.2.1-89.el8_6.14, +91 morefixed: vendor fix RHSA-2024:6220
-
Red Hat Enterprise Linux AppStream E4S (v.8.4) fence-agents 4.2.1-65.el8_4.20, fence-agents-all 4.2.1-65.el8_4.20, fence-agents-apc 4.2.1-65.el8_4.20, fence-agents-eps 4.2.1-65.el8_4.20, fence-agents-rsa 4.2.1-65.el8_4.20, fence-agents-rsb 4.2.1-65.el8_4.20, +91 morefixed: vendor fix RHSA-2024:6488
-
Red Hat Enterprise Linux AppStream E4S (v.8.6) fence-agents 4.2.1-89.el8_6.14, fence-agents-all 4.2.1-89.el8_6.14, fence-agents-apc 4.2.1-89.el8_6.14, fence-agents-eps 4.2.1-89.el8_6.14, fence-agents-rsa 4.2.1-89.el8_6.14, fence-agents-rsb 4.2.1-89.el8_6.14, +92 morefixed: vendor fix RHSA-2024:6220
-
Red Hat Enterprise Linux AppStream E4S (v.9.0) fence-virt 4.10.0-20.el9_0.17, fence-virtd 4.10.0-20.el9_0.17, fence-agents 4.10.0-20.el9_0.17, fence-virtd-cpg 4.10.0-20.el9_0.17, fence-virtd-tcp 4.10.0-20.el9_0.17, fence-agents-virsh 4.10.0-20.el9_0.17, +9 morefixed: vendor fix RHSA-2024:6612
-
Red Hat Enterprise Linux AppStream EUS (v.8.8) fence-agents 4.2.1-112.el8_8.8, fence-agents-all 4.2.1-112.el8_8.8, fence-agents-apc 4.2.1-112.el8_8.8, fence-agents-eps 4.2.1-112.el8_8.8, fence-agents-rsa 4.2.1-112.el8_8.8, fence-agents-rsb 4.2.1-112.el8_8.8, +94 morefixed: vendor fix RHSA-2024:5084
-
Red Hat Enterprise Linux AppStream EUS (v.9.2) fence-virt 4.10.0-43.el9_2.9, fence-virtd 4.10.0-43.el9_2.9, fence-agents 4.10.0-43.el9_2.9, fence-virtd-cpg 4.10.0-43.el9_2.9, fence-virtd-tcp 4.10.0-43.el9_2.9, fence-agents-virsh 4.10.0-43.el9_2.9, +10 morefixed: vendor fix RHSA-2024:6611
-
Red Hat Enterprise Linux AppStream TUS (v.8.4) fence-agents 4.2.1-65.el8_4.20, fence-agents-all 4.2.1-65.el8_4.20, fence-agents-apc 4.2.1-65.el8_4.20, fence-agents-eps 4.2.1-65.el8_4.20, fence-agents-rsa 4.2.1-65.el8_4.20, fence-agents-rsb 4.2.1-65.el8_4.20, +91 morefixed: vendor fix RHSA-2024:6488
-
Red Hat Enterprise Linux AppStream TUS (v.8.6) fence-agents 4.2.1-89.el8_6.14, fence-agents-all 4.2.1-89.el8_6.14, fence-agents-apc 4.2.1-89.el8_6.14, fence-agents-eps 4.2.1-89.el8_6.14, fence-agents-rsa 4.2.1-89.el8_6.14, fence-agents-rsb 4.2.1-89.el8_6.14, +91 morefixed: vendor fix RHSA-2024:6220
-
Red Hat Enterprise Linux BaseOS (v. 8) python-setuptools 39.2.0-8.el8_10, python3-setuptools 39.2.0-8.el8_10, python3-setuptools-wheel 39.2.0-8.el8_10, platform-python-setuptools 39.2.0-8.el8_10fixed: vendor fix RHSA-2024:5530
-
Red Hat Enterprise Linux BaseOS (v. 9) python-setuptools 53.0.0-12.el9_4.1, python3-setuptools 53.0.0-12.el9_4.1, python3-setuptools-wheel 53.0.0-12.el9_4.1fixed: vendor fix RHSA-2024:5534
-
Red Hat Enterprise Linux BaseOS AUS (v. 8.2) python-setuptools 39.2.0-5.el8_2.1, python3-setuptools 39.2.0-5.el8_2.1, python3-setuptools-wheel 39.2.0-5.el8_2.1, platform-python-setuptools 39.2.0-5.el8_2.1fixed: vendor fix RHSA-2024:6907
-
Red Hat Enterprise Linux BaseOS AUS (v.8.4) python-setuptools 39.2.0-6.el8_4.1, python3-setuptools 39.2.0-6.el8_4.1, python3-setuptools-wheel 39.2.0-6.el8_4.1, platform-python-setuptools 39.2.0-6.el8_4.1fixed: vendor fix RHSA-2024:5078
-
Red Hat Enterprise Linux BaseOS AUS (v.8.6) python-setuptools 39.2.0-7.el8_6.1, python3-setuptools 39.2.0-7.el8_6.1, python3-setuptools-wheel 39.2.0-7.el8_6.1, platform-python-setuptools 39.2.0-7.el8_6.1fixed: vendor fix RHSA-2024:5040
-
Red Hat Enterprise Linux BaseOS E4S (v.8.4) python-setuptools 39.2.0-6.el8_4.1, python3-setuptools 39.2.0-6.el8_4.1, python3-setuptools-wheel 39.2.0-6.el8_4.1, platform-python-setuptools 39.2.0-6.el8_4.1fixed: vendor fix RHSA-2024:5078
-
Red Hat Enterprise Linux BaseOS E4S (v.8.6) python-setuptools 39.2.0-7.el8_6.1, python3-setuptools 39.2.0-7.el8_6.1, python3-setuptools-wheel 39.2.0-7.el8_6.1, platform-python-setuptools 39.2.0-7.el8_6.1fixed: vendor fix RHSA-2024:5040
-
Red Hat Enterprise Linux BaseOS E4S (v.9.0) python-setuptools 53.0.0-12.el9_0, python3-setuptools 53.0.0-12.el9_0, python3-setuptools-wheel 53.0.0-12.el9_0fixed: vendor fix RHSA-2024:5389
-
Red Hat Enterprise Linux BaseOS EUS (v.8.8) python-setuptools 39.2.0-7.el8_8.1, python3-setuptools 39.2.0-7.el8_8.1, python3-setuptools-wheel 39.2.0-7.el8_8.1, platform-python-setuptools 39.2.0-7.el8_8.1fixed: vendor fix RHSA-2024:5000
-
Red Hat Enterprise Linux BaseOS EUS (v.9.2) python-setuptools 53.0.0-12.el9_2.1, python3-setuptools 53.0.0-12.el9_2.1, python3-setuptools-wheel 53.0.0-12.el9_2.1fixed: vendor fix RHSA-2024:5137
-
Red Hat Enterprise Linux BaseOS TUS (v.8.4) python-setuptools 39.2.0-6.el8_4.1, python3-setuptools 39.2.0-6.el8_4.1, python3-setuptools-wheel 39.2.0-6.el8_4.1, platform-python-setuptools 39.2.0-6.el8_4.1fixed: vendor fix RHSA-2024:5078
-
Red Hat Enterprise Linux BaseOS TUS (v.8.6) python-setuptools 39.2.0-7.el8_6.1, python3-setuptools 39.2.0-7.el8_6.1, python3-setuptools-wheel 39.2.0-7.el8_6.1, platform-python-setuptools 39.2.0-7.el8_6.1fixed: vendor fix RHSA-2024:5040
-
Red Hat Enterprise Linux CRB (v. 8) python3.12-setuptools-wheel 68.2.2-4.el8_10, pytest 6.0.2-2.module+el8.9.0+19644+d68f775d, Cython 0.29.21-5.module+el8.9.0+19644+d68f775d, pybind11 2.7.1-1.module+el8.9.0+19644+d68f775d, python-py 1.10.0-1.module+el8.9.0+19644+d68f775d, python39-py 1.10.0-1.module+el8.9.0+19644+d68f775d, +17 morefixed: vendor fix RHSA-2024:5962
-
Red Hat Enterprise Linux CRB (v. 9) python3.12-setuptools-wheel 68.2.2-3.el9_4.1fixed: vendor fix RHSA-2024:5533
-
Red Hat Enterprise Linux High Availability AUS (v.8.4) resource-agents 4.1.1-90.el8_4.18, fence-agents-aws 4.2.1-65.el8_4.20, fence-agents-gce 4.2.1-65.el8_4.20, fence-agents-aliyun 4.2.1-65.el8_4.20, resource-agents-gcp 4.1.1-90.el8_4.18, fence-agents-azure-arm 4.2.1-65.el8_4.20, +1 morefixed: vendor fix RHSA-2024:8170
-
Red Hat Enterprise Linux High Availability E4S (v.8.6) resource-agents 4.9.0-16.el8_6.14, fence-agents-aws 4.2.1-89.el8_6.14, fence-agents-gce 4.2.1-89.el8_6.14, fence-agents-aliyun 4.2.1-89.el8_6.14, resource-agents-gcp 4.9.0-16.el8_6.14, resource-agents-paf 4.9.0-16.el8_6.14, +2 morefixed: vendor fix RHSA-2024:8171
18 more fixed, 17 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
1.94% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| OSV | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | setuptools | <70.0.0 |
70.0.0 |
| bitnami | setuptools | <70.0.0 |
70.0.0 |
Affected products
- pypa pypa/setuptools
- python setuptools
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
github.com
/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0
web
-
github.com
/pypa/setuptools/pull/4332
web
-
huntr.com
/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
web
-
lists.debian.org
/debian-lts-announce/2024/09/msg00018.html
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-6345
advisory, web
-
github.com
/pypa/setuptools
package
-
github.com
/advisories/GHSA-cx63-2mw6-8hw5
web, advisory
-
pypi.org
/project/setuptools
package
Sources
- CVE List CVE-2024-6345
- GitHub Advisory GHSA-cx63-2mw6-8hw5
- NVD CVE-2024-6345
- OSV BIT-setuptools-2024-6345
- OSV PYSEC-2026-1918
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.