Incorrect Regular Expression in setuptools - CVE-2022-40897

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU71379

Incorrect Regular Expression in setuptools - CVE-2022-40897

Published: January 20, 2023


Vulnerability identifier: #VU71379
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-40897
CWE-ID: CWE-185
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing HTML content. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.


Affected software

setuptools
Dell Data Protection Central
Dell EMC PowerProtect Data Protection
Guardium Data Security Center (GDSC)
Cognos Dashboards on Cloud Pak for Data
ObjectScale
Netezza Performance Server Replication Services
QRadar Deployment Intelligence App
OpenManage Network Integration (OMNI)
QRadar Assistant
IBM Watson Machine Learning Accelerator
Enterprise SONiC
Platform Automation Toolkit
Database Operator for FoundationDB
SOAR QRadar Plugin App
Storage Ceph
Maximo Application Suite - IoT Component
Robotic Process Automation for Cloud Pak
Gentoo Linux
Amazon Linux AMI
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Micro
openSUSE Leap Micro
SUSE Linux Enterprise Micro for Rancher
Anolis OS
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Oracle Solaris
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Containers
SUSE Linux Enterprise Module for Public Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
Ubuntu
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Python3
SUSE Linux Enterprise Module for Basesystem
Basesystem Module
openSUSE Leap
openEuler
Fedora
Self Node Remediation Operator
Multicluster Engine for Kubernetes
OpenShift Service Mesh
OpenShift Data Foundation (formerly OpenShift Container Storage)
OpenShift Virtualization
SmartFabric Storage Software
Service Telemetry Framework
Migration Toolkit for Virtualization
Red Hat Advanced Cluster Management for Kubernetes
Qradar Advisor
IBM Watson Assistant for IBM Cloud Pak for Data
Splunk User Behavior Analytics (UBA)
OpenShift Logging
IBM Sterling Connect:Direct Web Services
IBM Robotic Process Automation
IBM Observability with Instana
Netcool Operations Insight
IBM Process Mining
Spectrum Discover
IBM MQ Operator
IBM Fusion HCI
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
Data Replication on Cloud Pak for Data
IBM Cloud Pak for Data Scheduling
App Connect Enterprise Certified Container
IBM Maximo Application Suite
IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes
IBM Spectrum Protect Plus Container Backup and Restore for OpenShift
IBM Spectrum Protect Plus
IBM Cloud Pak for Business Automation
Red Hat OpenShift GitOps
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
IBM QRadar DNS Analyzer App
IBM Netezza Analytics
Python for Scientific Computing
Splunk Enterprise
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
python3-setuptools (Ubuntu package)
python-setuptools (Ubuntu package)
pypy-setuptools (Ubuntu package)
python39-wcwidth
python2-pluggy
python2-PyMySQL
python39-PyMySQL
python39-toml
python39-pluggy
python2-docutils
python2-markupsafe
python2-Cython
python39-Cython
python2-wheel-wheel
python2-wheel
rh-python38-python-wheel (Red Hat package)
python39-wheel-wheel
python39-wheel
python2-scipy
python2-funcsigs
python2-backports
python2-ipaddress
python39-iniconfig
python2-sqlalchemy
python-sqlalchemy-doc
python2-nose
python-nose-docs
python2-py
python39-scipy
python2-pysocks
python39-pysocks
python2-pytest-mock
python39-py
python2-six
python2-numpy-f2py
python2-numpy
python2-numpy-doc
python39-cffi
python39-six
python2-dns
python2-setuptools_scm
python39-numpy-f2py
python39-numpy
python39-numpy-doc
python2-urllib3
python39-urllib3
python2-mock
python2-pygments
python39-pyparsing
babel
python2-babel
python2-idna
python39-pybind11-devel
python39-pybind11
python-psycopg2-doc
python2-psycopg2
python2-psycopg2-debug
python2-psycopg2-tests
python2-docs-info
python2-docs
python2-devel
python2-debug
python2-tools
python2-tkinter
python2-libs
python2-test
python2
rh-python38-python-cryptography (Red Hat package)
python39-psycopg2-doc
python39-psycopg2-tests
python39-psycopg2
python39-idna
python2-jinja2
python2-requests
python39-pycparser
rh-python38-python-requests (Red Hat package)
python39-requests
python2-chardet
python39-chardet
python39-cryptography
python2-pytest
python2-backports-ssl_match_hostname
python2-bson
python2-pymongo
python2-pymongo-gridfs
rh-python38-python (Red Hat package)
python39-devel
python39
python39-rpm-macros
python39-tkinter
python39-test
python39-debug
python39-idle
python39-libs
python39-ply
python2-pyyaml
python2-rpm-macros
python2-lxml
python2-coverage
python39-lxml
python39-mod_wsgi
python39-pyyaml
python39-psutil
python39-pytest
python39-more-itertools
python2-pip
python2-pip-wheel
python2-virtualenv
python2-attrs
rh-python38-python-pip (Red Hat package)
python39-pip-wheel
python39-pip
python39-attrs
python39-packaging
python-setuptools
python2-setuptools-wheel
python2-setuptools
python3-setuptools-wheel
platform-python-setuptools
python3-setuptools
python-setuptools (Red Hat package)
python3-setuptools-test
rh-python38-python-setuptools (Red Hat package)
python-setuptools-help
python36-setuptools
python39-setuptools
python39-setuptools-wheel
python310-setuptools
dev-python/setuptools
python2-pytz
PeopleSoft Enterprise PeopleTools
Operational Decision Manager
IBM Cognos Analytics
Dell EMC Storage Monitoring and Reporting (SMR)
EMC ViPR SRM
RecoverPoint for VMs
IBM Qradar SIEM

How to mitigate CVE-2022-40897

Install update from vendor's website.

setuptools - update to 65.5.1
Self Node Remediation Operator - update to 0.5.1
SmartFabric Storage Software - update to 1.4.3
Service Telemetry Framework - update to 1.5.4
Migration Toolkit for Containers - addressed in versions 1.7.8, 1.7.15, 1.8.3
Multicluster Engine for Kubernetes - update to 2.1.6
OpenShift Service Mesh - update to 2.3.2
Migration Toolkit for Virtualization - update to 2.4.3
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.5.8, 2.6.5
Qradar Advisor - update to 2.6.5
Guardium Data Security Center (GDSC) - update to 3.6.1
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
Python for Scientific Computing - update to 4.2.1
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4.11.7, 4.12.1, 4.12.2, 4.13.0
Red Hat OpenShift Container Platform - addressed in versions 4.11.54, 4.12.45, 4.13.24, 4.14.4
OpenShift Virtualization - update to 4.12.9
Splunk User Behavior Analytics (UBA) - update to 5.4.2
OpenShift Logging - addressed in versions 5.4.12, 5.5.8, 5.6.3
IBM Sterling Connect:Direct Web Services - update to 6.3.0.11 ifix001
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.0.9, 9.1.1, 9.1.4, 9.2.1
IBM Robotic Process Automation - addressed in versions 23.0.20.4, 30.0.0.1
IBM Observability with Instana - update to 274
python3-setuptools (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 39.0.1-2ubuntu0.1, 45.2.0-1ubuntu0.1, 59.6.0-1.2ubuntu0.22.04.1, 59.6.0-1.2ubuntu0.22.10.1
python-setuptools (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 39.0.1-2ubuntu0.1, 44.0.0-2ubuntu0.1, 44.1.1-1.2ubuntu0.22.04.1, 44.1.1-1.2ubuntu0.22.10.1
pypy-setuptools (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 39.0.1-2ubuntu0.1, 44.0.0-2ubuntu0.1, 44.1.1-1.2ubuntu0.22.04.1, 44.1.1-1.2ubuntu0.22.10.1
python39-wcwidth - update to 0.2.5-3
python2-pluggy - update to 0.6.0-8
python2-PyMySQL - update to 0.8.0-10
python39-PyMySQL - update to 0.10.1-2
python39-toml - update to 0.10.1-5
python39-pluggy - update to 0.13.1-3
python2-docutils - update to 0.14-12
python2-markupsafe - update to 0.23-19
python2-Cython - update to 0.28.1-7
python39-Cython - update to 0.29.21-5
python2-wheel-wheel - update to 0.31.1-3
python2-wheel - update to 0.31.1-3
rh-python38-python-wheel (Red Hat package) - update to 0.33.6-9.el7
python39-wheel-wheel - update to 0.35.1-4
python39-wheel - update to 0.35.1-4
python2-scipy - update to 1.0.0-22
python2-funcsigs - update to 1.0.2-13
python2-backports - update to 1.0-16
python2-ipaddress - update to 1.0.18-6
python39-iniconfig - update to 1.1.1-2
python2-sqlalchemy - update to 1.3.2-2
python-sqlalchemy-doc - update to 1.3.2-2
python2-nose - update to 1.3.7-31
python-nose-docs - update to 1.3.7-31
ObjectScale - update to 1.4.0
python2-py - update to 1.5.3-6
python39-scipy - update to 1.5.4-5.0.1
python2-pysocks - update to 1.6.8-6
Netcool Operations Insight - update to 1.6.10
python39-pysocks - update to 1.7.1-4
python2-pytest-mock - update to 1.9.0-4
python39-py - update to 1.10.0-1
python2-six - update to 1.11.0-6
python2-numpy-f2py - update to 1.14.2-16.0.1
python2-numpy - update to 1.14.2-16.0.1
python2-numpy-doc - update to 1.14.2-16.0.1
python39-cffi - update to 1.14.3-2
IBM Process Mining - update to 1.15.0 IF003
python39-six - update to 1.15.0-3
python2-dns - update to 1.15.0-10
python2-setuptools_scm - update to 1.15.7-6
python39-numpy-f2py - update to 1.19.4-3.0.1
python39-numpy - update to 1.19.4-3.0.1
python39-numpy-doc - update to 1.19.4-3.0.1
python2-urllib3 - update to 1.24.2-4
python39-urllib3 - update to 1.25.10-5
python2-mock - update to 2.0.0-13
IBM QRadar DNS Analyzer App - update to 2.0.3
Spectrum Discover - addressed in versions 2.0.4.8, 2.1.1
IBM MQ Operator - addressed in versions 2.0.10, 2.3.2
python2-pygments - update to 2.2.0-22
python39-pyparsing - update to 2.4.7-5
babel - update to 2.5.1-10
python2-babel - update to 2.5.1-10
python2-idna - update to 2.5-7
python39-pybind11-devel - update to 2.7.1-1
python39-pybind11 - update to 2.7.1-1
python-psycopg2-doc - update to 2.7.5-8
python2-psycopg2 - update to 2.7.5-8
python2-psycopg2-debug - update to 2.7.5-8
python2-psycopg2-tests - update to 2.7.5-8
python2-docs-info - update to 2.7.16-2
python2-docs - update to 2.7.16-2
python2-devel - update to 2.7.18-17.0.1
python2-debug - update to 2.7.18-17.0.1
python2-tools - update to 2.7.18-17.0.1
python2-tkinter - update to 2.7.18-17.0.1
python2-libs - update to 2.7.18-17.0.1
python2-test - update to 2.7.18-17.0.1
python2 - update to 2.7.18-17.0.1
IBM Fusion HCI - update to 2.8.0
rh-python38-python-cryptography (Red Hat package) - update to 2.8-6.el7
python39-psycopg2-doc - update to 2.8.6-3.0.1
python39-psycopg2-tests - update to 2.8.6-3.0.1
python39-psycopg2 - update to 2.8.6-3.0.1
python39-idna - update to 2.10-4
python2-jinja2 - update to 2.10-10
python2-requests - update to 2.20.0-4
python39-pycparser - update to 2.20-3
rh-python38-python-requests (Red Hat package) - update to 2.22.0-11.el7
python39-requests - update to 2.25.0-3
python2-chardet - update to 3.0.4-10
python39-chardet - update to 3.0.4-19
Netezza Performance Server Replication Services - update to 3.0.5.1
QRadar Deployment Intelligence App - update to 3.0.16
python39-cryptography - update to 3.3.1-3
python2-pytest - update to 3.4.2-13
python2-backports-ssl_match_hostname - update to 3.5.0.1-12
OpenManage Network Integration (OMNI) - update to 3.7
QRadar Assistant - update to 3.7.0
python2-bson - update to 3.7.0-1.0.1
python2-pymongo - update to 3.7.0-1.0.1
python2-pymongo-gridfs - update to 3.7.0-1.0.1
rh-python38-python (Red Hat package) - update to 3.8.18-2.el7
python39-devel - update to 3.9.19-2.0.1
python39 - update to 3.9.19-2.0.1
python39-rpm-macros - update to 3.9.19-2.0.1
python39-tkinter - update to 3.9.19-2.0.1
python39-test - update to 3.9.19-2.0.1
python39-debug - update to 3.9.19-2.0.1
python39-idle - update to 3.9.19-2.0.1
python39-libs - update to 3.9.19-2.0.1
python39-ply - update to 3.11-10
python2-pyyaml - update to 3.12-16
python2-rpm-macros - update to 3-38
IBM Watson Machine Learning Accelerator - update to 4.0
python2-lxml - update to 4.2.3-6
Enterprise SONiC - update to 4.4.1
Platform Automation Toolkit - addressed in versions 4.4.31, 5.0.24, 5.1.0
python2-coverage - update to 4.5.1-5
Database Operator for FoundationDB - update to 4.6
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.6.3
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.5
python39-lxml - update to 4.6.5-1
Data Replication on Cloud Pak for Data - update to 4.7.1
python39-mod_wsgi - update to 4.7.1-7
IBM Cloud Pak for Data Scheduling - update to 4.8.0
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.9.0.0
EMC ViPR SRM - update to 4.9.0.0
SOAR QRadar Plugin App - update to 5.0.3
App Connect Enterprise Certified Container - addressed in versions 5.0.5, 8.0.0
Storage Ceph - update to 5.3z2
python39-pyyaml - update to 5.4.1-1
python39-psutil - update to 5.8.0-4.0.1
RecoverPoint for VMs - update to 6.0.SP1.P1
python39-pytest - update to 6.0.2-2.0.1
IBM Qradar SIEM - update to 7.5.0 Update Pack 10 IF01
python39-more-itertools - update to 8.5.0-2
Maximo Application Suite - IoT Component - addressed in versions 8.7.21, 8.8.17, 9.0.7
IBM Maximo Application Suite - addressed in versions 8.8.6, 8.9.2
Operational Decision Manager - addressed in versions 8.10.5.1 Interim fix 49, 8.11.0.1 Interim fix 26, 8.12.0 Interim fix 8
python2-pip - update to 9.0.3-19.0.1
python2-pip-wheel - update to 9.0.3-19.0.1
IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes - update to 10.1.12.4
IBM Spectrum Protect Plus Container Backup and Restore for OpenShift - update to 10.1.12.4
IBM Spectrum Protect Plus - update to 10.1.13.1
IBM Cognos Analytics - addressed in versions 11.1.7 Fix Pack 8, 11.2.4 FP3, 12.0.2
IBM Netezza Analytics - update to 11.2.29
python2-virtualenv - update to 15.1.0-22
python2-attrs - update to 17.4.0-10
rh-python38-python-pip (Red Hat package) - update to 19.3.1-4.el7
python39-pip-wheel - update to 20.2.4-9
python39-pip - update to 20.2.4-9
python39-attrs - update to 20.3.0-2
python39-packaging - update to 20.4-4
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.3, 23.0.4
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF004, 24.0.1-IF001
python-setuptools - addressed in versions 36.5.0-3.3.1, 40.1.0-3.3.1, 40.6.2-4.21.1
python2-setuptools-wheel - update to 39.0.1-14
python2-setuptools - update to 39.0.1-14
python3-setuptools-wheel - update to 39.2.0-6
platform-python-setuptools - update to 39.2.0-6
python3-setuptools - update to 39.2.0-6
python-setuptools (Red Hat package) - addressed in versions 39.2.0-6.el8_7.1, 53.0.0-10.el9_1.1
python3-setuptools - addressed in versions 40.5.0-150100.6.6.1, 40.6.2-4.21.1, 44.1.1-150400.3.3.1, 44.1.1-150400.9.6.1
python3-setuptools-test - addressed in versions 40.5.0-150100.6.6.1, 44.1.1-150400.3.3.1, 44.1.1-150400.9.6.1
python3-setuptools-wheel - addressed in versions 40.5.0-150100.6.6.1, 44.1.1-150400.3.3.1, 44.1.1-150400.9.6.1
rh-python38-python-setuptools (Red Hat package) - update to 41.6.0-8.el7
python2-setuptools - update to 44.1.1-2
python3-setuptools - update to 44.1.1-2
python-setuptools - update to 44.1.1-2
python-setuptools-help - update to 44.1.1-2
python36-setuptools - update to 44.1.1-8.6.1
python39-setuptools - update to 44.1.1-150300.7.6.1
python39-setuptools-wheel - update to 50.3.2-5
python39-setuptools - update to 50.3.2-5
python310-setuptools - update to 57.4.0-150400.4.3.1
python-setuptools - update to 59.6.0-2
python-setuptools - addressed in versions 59.6.0-4.fc36, 62.6.0-3.fc37
dev-python/setuptools - update to 65.5.1
python2-pytz - update to 2017.2-13

External References

Related Security Bulletins