Code Injection in setuptools - CVE-2024-6345

Vulnerability identifier: #VU95339

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2024-6345

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
setuptools
watsonx Orchestrate Developer Edition
Guardium Data Security Center (GDSC)
watsonx Assistant for IBM Cloud Pak for Data
watsonx Code Assistant for Ansible
IBM Business Automation Manager Open Editions
Maximo Application Suite - Monitor Component
Maximo Application Suite - Predict Component
APEX Cloud Platform for Microsoft Azure
Netezza Performance Server Replication Services
QRadar Deployment Intelligence App
PowerStore T
OpenManage Network Integration (OMNI)
Security QRadar EDR
Enterprise SONiC
Cognos Dashboards on Cloud Pak for Data
Storage Resource Manager
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
SOAR QRadar Plugin App
Maximo Application Suite - IoT Component
Maximo Application Suite - Edge Data Collector
IBM Virtualization Engine TS7700 3948-VED
Maximo Application Suite - Visual Inspection Component
Storage Protect Plus File Systems Agent
IBM Netezza for Cloud Pak for Data
EMC Cloud Tiering Appliance
Robotic Process Automation for Cloud Pak
Oracle Linux
IBM AIX
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Desktop 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Software Development Kit 12
SUSE Manager Retail Branch Server
SUSE Manager Proxy Module
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Server Module
SUSE Manager Client Tools for SLE Micro
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
Anolis OS
SUSE Enterprise Storage
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
SUSE Manager Client Tools for RHEL, Liberty and Clones
SUSE Manager Client Tools for Debian
Public Cloud Module
Containers Module
SUSE Manager Client Tools for SLE
SUSE Linux Enterprise Server for the Raspberry Pi
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
Ubuntu
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Python 3 Module
Basesystem Module
openSUSE Leap
openEuler
Fedora
SUSE Manager Client Tools for Ubuntu 20.04
SUSE Manager Client Tools for Ubuntu 22.04
IBM InfoSphere Information Server
IBM VIOS
Oracle WebLogic Server
IBM Concert Software
PowerVC
Splunk User Behavior Analytics (UBA)
IBM Sterling Connect:Direct Web Services
IBM Spectrum Protect Plus
Service Interconnect
Run Once Duration Override Operator for Red Hat OpenShift
Multicluster GlobalHub
Migration Toolkit for Runtimes
IBM Process Mining
Qradar Advisor
Red Hat Advanced Cluster Management for Kubernetes
IBM Fusion HCI
APEX Cloud Platform for Red Hat OpenShift
Red Hat OpenShift Dev Spaces
IBM Cloud Object Storage Systems
QRadar User Behavior Analytics
Red Hat Advanced Cluster Security for Kubernetes
IBM Watson Discovery for IBM Cloud Pak for Data
Kube Descheduler Operator for Red Hat OpenShift
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
OpenShift Logging
App Connect Enterprise Certified Container
IBM Robotic Process Automation
IBM Business Automation Workflow
IBM Observability with Instana
SmartFabric Storage Software
Virtualization Engine TS7700 3957-VED
QRadar Suite
watsonx.data
Python for Scientific Computing
IBM Edge Application Manager
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
IBM Netezza Analytics
RecoverPoint for Virtual Machines
IBM Qradar SIEM
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
python3-setuptools (Ubuntu package)
pypy-setuptools (Ubuntu package)
python-setuptools (Ubuntu package)
python39-wcwidth
python-setuptools
python-setuptools (Red Hat package)
python39-PyMySQL
python39-toml
python39-pluggy
python39-Cython
python39-wheel
python39-wheel-wheel
python39-iniconfig
python39-scipy
python39-pysocks
python39-py
python39-cffi
python39-six
python39-numpy-f2py
python39-numpy
python39-numpy-doc
python39-urllib3
python39-pyparsing
python39-pybind11
python39-pybind11-devel
python2.7
python39-psycopg2-tests
python39-psycopg2
python39-psycopg2-doc
python39-idna
python39-pycparser
python39-requests
python39-chardet
python39-cryptography
python3.6
python39-debug
python39-devel
python39-idle
python39-libs
python39
python39-test
python39-tkinter
python39-rpm-macros
python39-ply
resource-agents (Red Hat package)
fence-agents (Red Hat package)
python39-lxml
python39-mod_wsgi
resource-agents-gcp
resource-agents-aliyun
resource-agents-paf
resource-agents
buku
fence-agents-apc-snmp
fence-agents-cisco-ucs
fence-agents-kubevirt
fence-agents-cisco-mds
fence-agents-brocade
fence-agents-kdump
fence-agents-all
fence-agents-redfish
fence-agents-aliyun
fence-agents-bladecenter
fence-agents-aws
fence-agents-azure-arm
fence-agents-apc
fence-agents-amt-ws
ha-cloud-support
fence-virtd-tcp
fence-virtd-serial
fence-virtd-multicast
fence-virtd-libvirt
fence-virtd-cpg
fence-virtd
fence-virt
fence-agents-gce
fence-agents-drac5
fence-agents-wti
fence-agents-vmware-soap
fence-agents-vmware-rest
fence-agents-virsh
fence-agents-scsi
fence-agents-sbd
fence-agents-rsb
fence-agents-rsa
fence-agents-rhevm
fence-agents-mpath
fence-agents-lpar
fence-agents-ipmilan
fence-agents-ipdu
fence-agents-intelmodular
fence-agents-ilo2
fence-agents-ilo-mp
fence-agents-common
fence-agents-eaton-snmp
fence-agents-emerson
fence-agents-eps
fence-agents-heuristics-ping
fence-agents-hpblade
fence-agents-ibm-powervs
fence-agents-ibm-vpc
fence-agents-ibmblade
fence-agents-ifmib
fence-agents-ilo-moonshot
fence-agents-ilo-ssh
python39-pyyaml
python39-psutil
python39-pytest
pypy
python39-more-itertools
python39-pip-wheel
python39-pip
python39-attrs
python39-packaging
python3-setuptools
python3-setuptools-wheel
platform-python-setuptools
python3-setuptools (Red Hat package)
python2-setuptools
python3-setuptools-test
python-setuptools-help
python36-setuptools
python39-setuptools
python39-setuptools-wheel
python3.11-setuptools (Red Hat package)
python310-setuptools
python311-setuptools
python311-setuptools-wheel
python3-setuptools-doc
python-setuptools-wheel
python312-setuptools
python3.12-setuptools (Red Hat package)
venv-salt-minion
RSA Authentication Manager
Red Hat OpenShift GitOps
Multicluster Engine for Kubernetes
OpenShift Service Mesh
OpenShift Virtualization
OpenShift Data Foundation (formerly OpenShift Container Storage)
Dell EMC Storage Monitoring and Reporting (SMR)
Red Hat Single Sign-On

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation when processing URL in the package_index module of pypa/setuptools. A remote attacker can send a specially crafted request and execute arbitrary code on the target system via download functions.

Install updates from vendor's website.

• https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
• https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0