mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-02-15 05:03:03 +01:00
Code Issues Packages Projects Releases Wiki Activity

python3-setuptools: Fix CVE-2024-6345

Browse Source 
A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1
allows for remote code execution via its download functions. These functions, which
are used to download packages from URLs provided by users or retrieved from package
index servers, are susceptible to code injection. If these functions are exposed to
user-controlled inputs, such as package URLs, they can execute arbitrary commands on
the system. The issue is fixed in version 70.0.

References:
https://nvd.nist.gov/vuln/detail/CVE-2024-6345
https://ubuntu.com/security/CVE-2024-6345

Upstream patch:
88807c7062

(From OE-Core rev: 238c305ba2c513a070818de4b6ad4316b54050a7)

Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Soumya Sambu
2025-04-25 04:50:26 +00:00
committed by Steve Sakoman
parent 520ba611e6
commit 8208d973b9
2 changed files with 354 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
meta/recipes-devtools/python/python3-setuptools_59.5.0.bb
View File

@@ -12,6 +12,7 @@ SRC_URI += "\
file://0001-change-shebang-to-python3.patch \
file://0001-_distutils-sysconfig-append-STAGING_LIBDIR-python-sy.patch \
file://0001-Limit-the-amount-of-whitespace-to-search-backtrack.-.patch \
file://CVE-2024-6345.patch \
"
SRC_URI[sha256sum] = "d144f85102f999444d06f9c0e8c737fd0194f10f2f7e5fdb77573f6e2fa4fad0"