Path traversal in setuptools - CVE-2025-47273

 

Path traversal in setuptools - CVE-2025-47273

Published: May 27, 2025


Vulnerability identifier: #VU109840
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-47273
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to input validation error when processing directory traversal sequences in package_index.py. A remote attacker can trick the victim into installing a specially crafted script and overwrite arbitrary files on the system, leading to code execution.


Affected software

setuptools
Netezza Appliance
watsonx Orchestrate Developer Edition
Storage Defender - Resiliency Service
Guardium Data Security Center (GDSC)
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
DataStage on Cloud Pak for Data
Maximo Application Suite - Visual Inspection Component
Maximo Application Suite Ai Service
IBM Security Verify Directory
Business Automation Insights
Astronomer with IBM
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
SOAR QRadar Plugin App
IBM Virtualization Engine TS7700 3948-VED
System Storage Virtualization Engine TS7700 3948-VEF
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Micro
SUSE Enterprise Storage
Red Hat CodeReady Linux Builder for Power, little endian
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Ubuntu
Public Cloud Module
Python 3 Module
Basesystem Module
openSUSE Leap
openEuler
Fedora
IBM Observability with Instana
Netcool Operations Insight
IBM Fusion HCI
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Maximo Application Suite
IBM Robotic Process Automation
IBM Business Automation Workflow
Ansible Automation Platform
Red Hat Advanced Cluster Management for Kubernetes
Red Hat Advanced Cluster Security for Kubernetes
watsonx.data
IBM Qradar SIEM
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
python39-wcwidth
python-setuptools (Red Hat package)
python39-PyMySQL
python39-toml
python39-pluggy
python39-Cython
python39-wheel
python39-wheel-wheel
python39-iniconfig
automation-eda-controller (Red Hat package)
python39-scipy
python39-pysocks
python39-py
python39-cffi
python39-six
python39-numpy-f2py
python39-numpy-doc
python39-numpy
python39-urllib3
python39-pyparsing
ansible-automation-platform-installer (Red Hat package)
automation-gateway (Red Hat package)
python3.11-django-ansible-base (Red Hat package)
python39-pybind11-devel
python39-pybind11
python39-psycopg2-tests
python39-psycopg2-doc
python39-psycopg2
python39-idna
python39-pycparser
python39-requests
python39-chardet
python-setuptools (Ubuntu package)
python39-cryptography
python39-rpm-macros
python39-libs
python39-idle
python39-tkinter
python39-test
python39
python39-debug
python39-devel
python39-ply
python3.11-django (Red Hat package)
python39-lxml
automation-controller (Red Hat package)
python39-mod_wsgi
fence-agents (Red Hat package)
fence-agents-ifmib
fence-agents-ilo-moonshot
fence-agents-ilo-mp
fence-agents-ilo-ssh
fence-agents-ilo2
fence-agents-intelmodular
fence-agents-ipdu
fence-agents-ipmilan
fence-agents-lpar
fence-agents-mpath
fence-agents-rhevm
fence-agents-rsa
fence-agents-rsb
fence-agents-sbd
fence-agents-scsi
fence-agents-virsh
fence-agents-vmware-rest
fence-agents-vmware-soap
fence-agents-wti
fence-agents-emerson
fence-agents-ibm-vpc
fence-agents-all
fence-agents-kdump
fence-agents-kubevirt
fence-agents-redfish
fence-virt
fence-virtd
fence-virtd-cpg
fence-virtd-libvirt
fence-virtd-multicast
fence-virtd-serial
fence-virtd-tcp
fence-agents-amt-ws
fence-agents-apc
fence-agents-eaton-snmp
fence-agents-hpblade
fence-agents-ibm-powervs
fence-agents-ibmblade
fence-agents-apc-snmp
fence-agents-heuristics-ping
fence-agents-eps
fence-agents-drac5
fence-agents-common
fence-agents-cisco-ucs
fence-agents-cisco-mds
fence-agents-brocade
fence-agents-bladecenter
python3.11-galaxy-ng (Red Hat package)
automation-hub (Red Hat package)
python39-pyyaml
python39-psutil
python39-pytest
pypy
python-pip (Ubuntu package)
python39-more-itertools
python39-pip
python39-pip-wheel
python39-attrs
python39-packaging
python3-setuptools-wheel
python3-setuptools
platform-python-setuptools
python3-setuptools (Red Hat package)
python3-setuptools-test
python-setuptools
python-setuptools-help
python2-setuptools
python36-setuptools
python39-setuptools
python39-setuptools-wheel
python3.11-setuptools (Red Hat package)
python3.11-setuptools
python3.11-setuptools-wheel
python310-setuptools
python311-setuptools
python311-setuptools-wheel
python-setuptools-wheel
python3-setuptools-doc
python312-setuptools
python3.12-setuptools (Red Hat package)
python313-setuptools
mingw-python-setuptools
Splunk Enterprise
Splunk Security Orchestration, Automation and Response (SOAR)
IBM API Connect
IBM InfoSphere Information Server
Red Hat OpenShift Serverless
Multicluster Engine for Kubernetes
OpenShift Virtualization
Red Hat OpenShift Container Platform
Red Hat Ceph Storage
Virtualization Engine TS7700 3957-VED
Juniper Junos Space

How to mitigate CVE-2025-47273

Install updates from vendor's website.

setuptools - update to 78.1.1
Netezza Appliance - update to 1.0.1.0 fp278500
IBM Observability with Instana - update to 1.0.307
watsonx Orchestrate Developer Edition - update to 1.13.0
Netcool Operations Insight - update to 1.6.15
Storage Defender - Resiliency Service - update to 2.0.15
watsonx.data - update to 2.2.1
IBM Fusion HCI - update to 2.10.1
Guardium Data Security Center (GDSC) - update to 3.8.5
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.2.2
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2.0.1
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.2.1
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 5.2
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component - update to 5.2.1
IBM Qradar SIEM - update to 7.5.0 Update Pack 13 IF01
IBM Maximo Application Suite - addressed in versions 8.10.30, 8.11.27, 9.0.16, 9.1.5
Maximo Application Suite - Visual Inspection Component - addressed in versions 9.0.17, 9.1.6
Splunk Enterprise - addressed in versions 9.2.10, 9.3.8, 9.4.6, 10.0.2
Maximo Application Suite Ai Service - update to 9.1.15
IBM Security Verify Directory - update to 10.0.4.3
IBM API Connect - update to 10.0.8.5
IBM InfoSphere Information Server - update to 11.7.1.6 Service pack 1
IBM Robotic Process Automation - addressed in versions 23.0.20.4, 30.0.0.1
IBM Business Automation Workflow - update to 24.0.0-IF006
Business Automation Insights - addressed in versions 24.0.0.0.5, 24.0.1.0.6, 25.0.0.0.3
python39-wcwidth - update to 0.2.5-3
python-setuptools (Red Hat package) - addressed in versions 0.9.8-7.el7_9.2, 39.2.0-5.el8_2.2, 39.2.0-6.el8_4.2, 39.2.0-7.el8_6.2, 39.2.0-7.el8_8.3, 53.0.0-12.el9_2.3, 53.0.0-12.el9_4.2, 53.0.0-13.el9_0, 53.0.0-13.el9_6.1, 69.0.3-12.el10_0
python39-PyMySQL - update to 0.10.1-2
python39-toml - update to 0.10.1-5
python39-pluggy - update to 0.13.1-3
python39-Cython - update to 0.29.21-5
python39-wheel - update to 0.35.1-4
python39-wheel-wheel - update to 0.35.1-4
Red Hat OpenShift Serverless - update to 1
Astronomer with IBM - update to 1.1.0
python39-iniconfig - update to 1.1.1-2
automation-eda-controller (Red Hat package) - addressed in versions 1.1.13-1.el8ap, 1.1.13-1.el9ap
python39-scipy - update to 1.5.4-5.0.1
python39-pysocks - update to 1.7.1-4
python39-py - update to 1.10.0-1
python39-cffi - update to 1.14.3-2
python39-six - update to 1.15.0-3
python39-numpy-f2py - update to 1.19.4-3.0.1
python39-numpy-doc - update to 1.19.4-3.0.1
python39-numpy - update to 1.19.4-3.0.1
python39-urllib3 - update to 1.25.10-5
python39-pyparsing - update to 2.4.7-5
Ansible Automation Platform - update to 2.5
ansible-automation-platform-installer (Red Hat package) - addressed in versions 2.5-17.el8ap, 2.5-17.el9ap
automation-gateway (Red Hat package) - addressed in versions 2.5.20250827-1.el8ap, 2.5.20250827-1.el9ap
python3.11-django-ansible-base (Red Hat package) - addressed in versions 2.5.20250827-1.el8ap, 2.5.20250827-1.el9ap
Multicluster Engine for Kubernetes - addressed in versions 2.6.8, 2.8.3
python39-pybind11-devel - update to 2.7.1-1
python39-pybind11 - update to 2.7.1-1
python39-psycopg2-tests - update to 2.8.6-3.0.1
python39-psycopg2-doc - update to 2.8.6-3.0.1
python39-psycopg2 - update to 2.8.6-3.0.1
python39-idna - update to 2.10-4
Red Hat Advanced Cluster Management for Kubernetes - update to 2.13.4
python39-pycparser - update to 2.20-3
python39-requests - update to 2.25.0-3
python39-chardet - update to 3.0.4-19
python-setuptools (Ubuntu package) - addressed in versions 3.3-1ubuntu2+esm3, 20.7.0-1ubuntu0.1~esm3, 39.0.1-2ubuntu0.1+esm2, 44.0.0-2ubuntu0.1+esm2, 44.1.1-1.2ubuntu0.22.04.1+esm2, 45.2.0-1ubuntu0.3, 59.6.0-1.2ubuntu0.22.04.3, 68.1.2-2ubuntu1.2, 74.1.2-1ubuntu0.1, 75.8.0-1ubuntu1
python39-cryptography - update to 3.3.1-3
python39-rpm-macros - update to 3.9.20-2.0.1
python39-libs - update to 3.9.20-2.0.1
python39-idle - update to 3.9.20-2.0.1
python39-tkinter - update to 3.9.20-2.0.1
python39-test - update to 3.9.20-2.0.1
python39 - update to 3.9.20-2.0.1
python39-debug - update to 3.9.20-2.0.1
python39-devel - update to 3.9.20-2.0.1
python39-ply - update to 3.11-10
python3.11-django (Red Hat package) - addressed in versions 4.2.23-1.el8ap, 4.2.23-1.el9ap
python39-lxml - update to 4.6.5-1
automation-controller (Red Hat package) - addressed in versions 4.6.19-1.el8ap, 4.6.19-1.el9ap
python39-mod_wsgi - update to 4.7.1-7
Red Hat Advanced Cluster Security for Kubernetes - update to 4.7.5
fence-agents (Red Hat package) - addressed in versions 4.10.0-20.el9_0.23, 4.10.0-43.el9_2.14, 4.10.0-62.el9_4.15, 4.10.0-86.el9_6.7
fence-agents-ifmib - update to 4.10.0-86.0.1
fence-agents-ilo-moonshot - update to 4.10.0-86.0.1
fence-agents-ilo-mp - update to 4.10.0-86.0.1
fence-agents-ilo-ssh - update to 4.10.0-86.0.1
fence-agents-ilo2 - update to 4.10.0-86.0.1
fence-agents-intelmodular - update to 4.10.0-86.0.1
fence-agents-ipdu - update to 4.10.0-86.0.1
fence-agents-ipmilan - update to 4.10.0-86.0.1
fence-agents-lpar - update to 4.10.0-86.0.1
fence-agents-mpath - update to 4.10.0-86.0.1
fence-agents-rhevm - update to 4.10.0-86.0.1
fence-agents-rsa - update to 4.10.0-86.0.1
fence-agents-rsb - update to 4.10.0-86.0.1
fence-agents-sbd - update to 4.10.0-86.0.1
fence-agents-scsi - update to 4.10.0-86.0.1
fence-agents-virsh - update to 4.10.0-86.0.1
fence-agents-vmware-rest - update to 4.10.0-86.0.1
fence-agents-vmware-soap - update to 4.10.0-86.0.1
fence-agents-wti - update to 4.10.0-86.0.1
fence-agents-emerson - update to 4.10.0-86.0.1
fence-agents-ibm-vpc - update to 4.10.0-86.0.1
fence-agents-all - update to 4.10.0-86.0.1
fence-agents-kdump - update to 4.10.0-86.0.1
fence-agents-kubevirt - update to 4.10.0-86.0.1
fence-agents-redfish - update to 4.10.0-86.0.1
fence-virt - update to 4.10.0-86.0.1
fence-virtd - update to 4.10.0-86.0.1
fence-virtd-cpg - update to 4.10.0-86.0.1
fence-virtd-libvirt - update to 4.10.0-86.0.1
fence-virtd-multicast - update to 4.10.0-86.0.1
fence-virtd-serial - update to 4.10.0-86.0.1
fence-virtd-tcp - update to 4.10.0-86.0.1
fence-agents-amt-ws - update to 4.10.0-86.0.1
fence-agents-apc - update to 4.10.0-86.0.1
fence-agents-eaton-snmp - update to 4.10.0-86.0.1
fence-agents-hpblade - update to 4.10.0-86.0.1
fence-agents-ibm-powervs - update to 4.10.0-86.0.1
fence-agents-ibmblade - update to 4.10.0-86.0.1
fence-agents-apc-snmp - update to 4.10.0-86.0.1
fence-agents-heuristics-ping - update to 4.10.0-86.0.1
fence-agents-eps - update to 4.10.0-86.0.1
fence-agents-drac5 - update to 4.10.0-86.0.1
fence-agents-common - update to 4.10.0-86.0.1
fence-agents-cisco-ucs - update to 4.10.0-86.0.1
fence-agents-cisco-mds - update to 4.10.0-86.0.1
fence-agents-brocade - update to 4.10.0-86.0.1
fence-agents-bladecenter - update to 4.10.0-86.0.1
python3.11-galaxy-ng (Red Hat package) - addressed in versions 4.10.7-1.el8ap, 4.10.7-1.el9ap
automation-hub (Red Hat package) - addressed in versions 4.10.7-1.el8ap, 4.10.7-1.el9ap
OpenShift Virtualization - update to 4.12.20
Red Hat OpenShift Container Platform - addressed in versions 4.12.79, 4.14.54, 4.14.55, 4.15.56, 4.16.46, 4.17.37, 4.18.22, 4.19.7
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.2.1
python39-pyyaml - update to 5.4.1-1
SOAR QRadar Plugin App - update to 5.6.2
python39-psutil - update to 5.8.0-4.0.1
python39-pytest - update to 6.0.2-2.0.1
Splunk Security Orchestration, Automation and Response (SOAR) - update to 7.0.0
Red Hat Ceph Storage - update to 7.1
pypy - addressed in versions 7.3.20-2.fc41, 7.3.20-2.fc42, 7.3.20-2.fc43
python-pip (Ubuntu package) - addressed in versions 8.1.1-2ubuntu0.6+esm12, 9.0.1-2.3~ubuntu1.18.04.8+esm8, 20.0.2-5ubuntu1.11+esm4
python39-more-itertools - update to 8.5.0-2
IBM Virtualization Engine TS7700 3948-VED - addressed in versions 8.54.1.27 VTD_EXEC.407, 8.54.2.17 VTD_EXEC.407, 8.60.0.115 VTD_EXEC.407, 8.61.0.60
Virtualization Engine TS7700 3957-VED - addressed in versions 8.54.1.27 VTD_EXEC.407, 8.60.0.115 VTD_EXEC.407, 8.61.0.60
System Storage Virtualization Engine TS7700 3948-VEF - addressed in versions 8.60.0.115 VTD_EXEC.407, 8.61.0.60
python39-pip - update to 20.2.4-9
python39-pip-wheel - update to 20.2.4-9
python39-attrs - update to 20.3.0-2
python39-packaging - update to 20.4-4
Juniper Junos Space - addressed in versions 24.1R5, 26.1R1 Patch V1
python3-setuptools-wheel - update to 39.2.0-9
python3-setuptools - addressed in versions 39.2.0-9, 68.0.0-3
platform-python-setuptools - update to 39.2.0-9
python3-setuptools (Red Hat package) - update to 39.2.0-10.el7_9.2
python3-setuptools-test - addressed in versions 40.5.0-150100.6.12.1, 44.1.1-150400.9.12.1
python3-setuptools - addressed in versions 40.5.0-150100.6.12.1, 44.1.1-150400.9.12.1
python3-setuptools-wheel - addressed in versions 40.5.0-150100.6.12.1, 44.1.1-150400.9.12.1
python-setuptools - addressed in versions 44.1.1-6, 59.4.0-8, 68.0.0-4
python-setuptools-help - addressed in versions 44.1.1-6, 59.4.0-8, 68.0.0-4
python3-setuptools - addressed in versions 44.1.1-6, 59.4.0-8, 68.0.0-4
python2-setuptools - update to 44.1.1-6
python36-setuptools - update to 44.1.1-8.12.1
python39-setuptools - update to 44.1.1-150300.7.12.1
python39-setuptools - update to 50.3.2-7
python39-setuptools-wheel - update to 50.3.2-7
python3.11-setuptools (Red Hat package) - addressed in versions 65.5.1-2.el8_8.2, 65.5.1-2.el9_2.2, 65.5.1-2.el9_4.2, 65.5.1-4.el8_10, 65.5.1-4.el9_6
python3.11-setuptools - update to 65.5.1-4
python3.11-setuptools-wheel - update to 65.5.1-4
python310-setuptools - update to 67.6.1-150400.4.12.1
python311-setuptools - addressed in versions 67.7.2-150400.3.19.1, 69.0.2-3.1
python311-setuptools-wheel - update to 67.7.2-150400.3.19.1
python-setuptools-wheel - update to 68.0.0-3
python3-setuptools-doc - update to 68.0.0-3
python312-setuptools - update to 68.1.2-150600.3.6.1
python3.12-setuptools (Red Hat package) - addressed in versions 68.2.2-5.el8_10, 68.2.2-5.el9_6
python-setuptools - addressed in versions 69.2.0-10.fc41, 74.1.3-7.fc42
python313-setuptools - update to 72.1.0-150700.3.3.1
mingw-python-setuptools - addressed in versions 78.1.1-1.fc41, 78.1.1-1.fc42

External References

Related Security Bulletins