Description

briensea

opened on Mar 29, 2025

Issue body actions

Update bundled setuptools to address CVE-2024-6345, CVE-2022-40897 in cpython 3.9, 3.10 & 3.11

Description:

Security vulnerabilities, CVE-2024-6345 and CVE-2022-40897, have been identified in older versions of setuptools. The versions of setuptools bundled with CPython 3.9, 3.10, and 3.11 are affected.

This results in users being required to manually update setuptools to mitigate these security vulnerabilities.

CPython versions affected:

• 3.9 (bundled setuptools version outdated)
• 3.10 (bundled setuptools version outdated)
• 3.11 (bundled setuptools version outdated)

Operating systems tested on:

• Linux

Activity

1. picnixz

   added

   type-securityA security issueA security issue

   3.11only security fixesonly security fixes

   3.10 (EOL)end of lifeend of life

   3.9 (EOL)end of lifeend of life

   dependenciesPull requests that update a dependency filePull requests that update a dependency file

   and removed

   dependenciesPull requests that update a dependency filePull requests that update a dependency file

   on Mar 29, 2025
2. picnixz commented on Mar 29, 2025

   

   picnixz

   on Mar 29, 2025

   Member

   More actions

   cc @sethmlarson @gpshead
3. picnixz

   added

   stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

   on Mar 29, 2025
4. zware commented on Apr 1, 2025

   

   zware

   on Apr 1, 2025

   Member

   More actions

   Duplicate of gh-102202.
5. zware

   closed this as a duplicateof Update bundled setuptools provided by ensurepip in current 3.8.x through 3.11.x to include fix for CVE-2022-40897? #102202 on Apr 1, 2025
6. laptchik commented on Apr 8, 2025

   

   laptchik

   on Apr 8, 2025

   More actions

   @zware why it's a duplicate if it's two totally different CVEs. CVE-2024-6345 wasn't discussed there and it has higher priority
7. sethmlarson commented on Apr 8, 2025

   

   sethmlarson

   on Apr 8, 2025

   Contributor

   More actions

   @laptchik The justification for not updating the bundled copy is the same, if it's possible to securely upgrade pip and setuptools in your own installation of Python then there's no need to upgrade the bundled copy. As a user you can fix the vulnerability by upgrading the library or by creating an environment and installing setuptools/pip yourself into that environment.

   Reacted by Zachary Ware
8. laptchik commented on Apr 8, 2025

   

   laptchik

   on Apr 8, 2025

   More actions

   @sethmlarson i thought it was closed not because it can be manually fixed, but because THAT cve is not a big deal, no?
   With that, let's close. It's not a notable security vulnerability in Python. Telling that to your security scanner is, in this case, up to you.
9. vuchuoverjet commented on Sep 3, 2025

   

   vuchuoverjet

   on Sep 3, 2025

   More actions

   @laptchik The justification for not updating the bundled copy is the same, if it's possible to securely upgrade pip and setuptools in your own installation of Python then there's no need to upgrade the bundled copy. As a user you can fix the vulnerability by upgrading the library or by creating an environment and installing setuptools/pip yourself into that environment.

   Hello, We're facing the same issue. We could, of course, upgrade pip and setuptools to latest versions, but what about the ones in ensurepip/_bundled ? They're still subjected to be scanned.

   cc: @sethmlarson
10. hugovk commented on Sep 3, 2025

    

    hugovk

    on Sep 3, 2025

    Member

    More actions

    You should configure your scanner to ignore files you are not using.

    Reacted by Seth Larson and Zachary Ware

Issue actions