Bug 2366982 (CVE-2025-47273)

Summary: CVE-2025-47273 setuptools: Path Traversal Vulnerability in setuptools PackageIndex
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aasthana, abarbaro, adinn, adudiak, anpicker, anthomas, aprice, bbrownin, bdettelb, caswilli, cmah, crizzo, dfreiber, dhanak, dnakabaa, doconnor, drosa, drow, dsimansk, eglynn, ehelms, fzakkak, galder.zamarreno, ggainey, gkamathe, gtanzill, haoli, hasun, hkataria, hukhan, jajackso, jburrell, jbuscemi, jcammara, jcantril, jchui, jdobes, jfula, jhe, jjoyce, jkoehler, jmitchel, jneedle, jowilson, jsamir, jtanner, juwatts, jwong, kaycoth, kegrant, kgaikwad, kholdawa, kingland, koliveir, kshier, ktsao, kverlaen, lball, lcouzens, ljawale, lphiri, luizcosta, mabashia, matzew, mbabacek, mburns, mgarciac, mhulan, mnovotny, mprahl, mrunge, mskarbek, nboldt, ngough, nkathole, nmoumoul, nweather, nyancey, oezr, olubyans, omaciel, ometelka, orabin, osousa, pakotvan, pbraun, pcreech, periklis, pjindal, psrna, ptisnovs, rbobbitt, rchan, rojacob, sausingh, sbiarozk, sdawley, sgehwolf, shvarugh, simaishi, smallamp, smcdonal, stcannon, sthirugn, syedriko, teagle, tfister, thavo, tmalecek, tqvarnst, ttakamiy, veshanka, vimartin, vkrizan, vkumar, xdharmai, xiaoxwan, yguenane, zzhou
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A path traversal vulnerability in the Python setuptools library allows attackers with limited system access to write files outside the intended temporary directory by manipulating package download URLs. This flaw bypasses basic filename sanitization and can lead to unauthorized overwrites of important system files, creating opportunities for further compromise. While it doesn't expose data or require user interaction, it poses a high integrity risk and is especially concerning in environments that rely on automated package handling or internal tooling built on setuptools.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2372616, 2372617, 2367429, 2367430, 2372612, 2372613, 2372614, 2372615    
Bug Blocks:    

Description OSIDB Bzimport 2025-05-17 16:01:04 UTC
setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue.

Comment 5 errata-xmlrpc 2025-06-30 12:40:11 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:9940 https://access.redhat.com/errata/RHSA-2025:9940

Comment 6 errata-xmlrpc 2025-07-07 11:52:45 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:10407 https://access.redhat.com/errata/RHSA-2025:10407

Comment 8 errata-xmlrpc 2025-07-15 01:02:09 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:11043 https://access.redhat.com/errata/RHSA-2025:11043

Comment 9 errata-xmlrpc 2025-07-15 01:26:22 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:11036 https://access.redhat.com/errata/RHSA-2025:11036

Comment 10 errata-xmlrpc 2025-07-15 01:30:29 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:11044 https://access.redhat.com/errata/RHSA-2025:11044

Comment 11 errata-xmlrpc 2025-07-15 09:34:46 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:11102 https://access.redhat.com/errata/RHSA-2025:11102

Comment 12 errata-xmlrpc 2025-07-15 09:35:13 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2025:11101 https://access.redhat.com/errata/RHSA-2025:11101

Comment 18 errata-xmlrpc 2025-07-21 08:16:23 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support

Via RHSA-2025:11426 https://access.redhat.com/errata/RHSA-2025:11426

Comment 19 errata-xmlrpc 2025-07-21 08:18:02 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2025:11425 https://access.redhat.com/errata/RHSA-2025:11425

Comment 20 errata-xmlrpc 2025-07-21 08:25:49 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2025:11427 https://access.redhat.com/errata/RHSA-2025:11427

Comment 21 errata-xmlrpc 2025-07-21 08:31:33 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2025:11424 https://access.redhat.com/errata/RHSA-2025:11424

Comment 22 errata-xmlrpc 2025-07-21 15:00:08 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2025:11464 https://access.redhat.com/errata/RHSA-2025:11464

Comment 23 errata-xmlrpc 2025-07-21 15:35:30 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:11463 https://access.redhat.com/errata/RHSA-2025:11463

Comment 24 errata-xmlrpc 2025-07-23 05:32:16 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2025:11584 https://access.redhat.com/errata/RHSA-2025:11584

Comment 26 errata-xmlrpc 2025-07-23 11:35:17 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2025:11607 https://access.redhat.com/errata/RHSA-2025:11607

Comment 27 errata-xmlrpc 2025-07-28 10:11:50 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:11868 https://access.redhat.com/errata/RHSA-2025:11868

Comment 28 errata-xmlrpc 2025-07-28 16:47:32 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2025:11984 https://access.redhat.com/errata/RHSA-2025:11984

Comment 29 errata-xmlrpc 2025-07-29 05:16:27 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2025:12020 https://access.redhat.com/errata/RHSA-2025:12020

Comment 32 errata-xmlrpc 2025-08-05 03:34:24 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:12834 https://access.redhat.com/errata/RHSA-2025:12834

Comment 34 errata-xmlrpc 2025-08-11 07:45:00 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:13578 https://access.redhat.com/errata/RHSA-2025:13578

Comment 37 errata-xmlrpc 2025-08-12 00:41:02 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:13669 https://access.redhat.com/errata/RHSA-2025:13669

Comment 38 errata-xmlrpc 2025-08-12 00:44:10 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:13668 https://access.redhat.com/errata/RHSA-2025:13668

Comment 43 errata-xmlrpc 2025-08-13 15:22:56 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2025:13803 https://access.redhat.com/errata/RHSA-2025:13803

Comment 44 errata-xmlrpc 2025-08-13 15:30:22 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2025:13804 https://access.redhat.com/errata/RHSA-2025:13804

Comment 51 errata-xmlrpc 2025-08-26 21:00:05 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.5 for RHEL 8
  Red Hat Ansible Automation Platform 2.5 for RHEL 9

Via RHSA-2025:14686 https://access.redhat.com/errata/RHSA-2025:14686

Comment 57 errata-xmlrpc 2025-08-28 16:56:48 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:14900 https://access.redhat.com/errata/RHSA-2025:14900

Comment 58 errata-xmlrpc 2025-09-08 01:12:42 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2025:15411 https://access.redhat.com/errata/RHSA-2025:15411

Comment 59 errata-xmlrpc 2025-09-08 01:21:26 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

Via RHSA-2025:15408 https://access.redhat.com/errata/RHSA-2025:15408

Comment 60 errata-xmlrpc 2025-09-08 01:22:07 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2025:15410 https://access.redhat.com/errata/RHSA-2025:15410