UBUNTU-CVE-2024-6345

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2024-6345

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-6345.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2024-6345

Related

Published

2024-07-15T01:15:00Z

Modified

2024-10-17T08:30:52Z

Summary

[none]

Details

A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.

References

Affected packages

Ubuntu:Pro:14.04:LTS / python-pip

Package

Name: python-pip
Purl: pkg:deb/ubuntu/python-pip?arch=src?distro=trusty/esm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.5.4-1ubuntu4+esm5

Affected versions

1.*

1.4.1-2

1.5.4-1

1.5.4-1ubuntu1

1.5.4-1ubuntu3

1.5.4-1ubuntu4

1.5.4-1ubuntu4+esm1

1.5.4-1ubuntu4+esm2

1.5.4-1ubuntu4+esm3

1.5.4-1ubuntu4+esm4

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.5.4-1ubuntu4+esm5",
            "binary_name": "python-pip"
        },
        {
            "binary_version": "1.5.4-1ubuntu4+esm5",
            "binary_name": "python-pip-whl"
        },
        {
            "binary_version": "1.5.4-1ubuntu4+esm5",
            "binary_name": "python3-pip"
        }
    ]
}

Ubuntu:Pro:14.04:LTS / python-setuptools

Package

Name: python-setuptools
Purl: pkg:deb/ubuntu/python-setuptools?arch=src?distro=trusty/esm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.3-1ubuntu2+esm2

Affected versions

1.*

1.4.2-1

2.*

2.0.1-1ubuntu1

2.0.1-2ubuntu1

2.0.2-1

2.1-1

2.2-1

3.*

3.3-1ubuntu1

3.3-1ubuntu2

3.3-1ubuntu2+esm1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "3.3-1ubuntu2+esm2",
            "binary_name": "python-pkg-resources"
        },
        {
            "binary_version": "3.3-1ubuntu2+esm2",
            "binary_name": "python-setuptools"
        },
        {
            "binary_version": "3.3-1ubuntu2+esm2",
            "binary_name": "python-setuptools-doc"
        },
        {
            "binary_version": "3.3-1ubuntu2+esm2",
            "binary_name": "python-setuptools-whl"
        },
        {
            "binary_version": "3.3-1ubuntu2+esm2",
            "binary_name": "python3-pkg-resources"
        },
        {
            "binary_version": "3.3-1ubuntu2+esm2",
            "binary_name": "python3-setuptools"
        }
    ]
}

Ubuntu:Pro:16.04:LTS / python-setuptools

Package

Name: python-setuptools
Purl: pkg:deb/ubuntu/python-setuptools?arch=src?distro=esm-infra/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

20.7.0-1ubuntu0.1~esm2

Affected versions

18.*

18.4-1

18.4-2

18.7-1

18.8-1

20.*

20.1.1-1

20.3.1-1

20.7.0-1

20.7.0-1ubuntu0.1~esm1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "20.7.0-1ubuntu0.1~esm2",
            "binary_name": "pypy-pkg-resources"
        },
        {
            "binary_version": "20.7.0-1ubuntu0.1~esm2",
            "binary_name": "pypy-setuptools"
        },
        {
            "binary_version": "20.7.0-1ubuntu0.1~esm2",
            "binary_name": "python-pkg-resources"
        },
        {
            "binary_version": "20.7.0-1ubuntu0.1~esm2",
            "binary_name": "python-setuptools"
        },
        {
            "binary_version": "20.7.0-1ubuntu0.1~esm2",
            "binary_name": "python-setuptools-doc"
        },
        {
            "binary_version": "20.7.0-1ubuntu0.1~esm2",
            "binary_name": "python3-pkg-resources"
        },
        {
            "binary_version": "20.7.0-1ubuntu0.1~esm2",
            "binary_name": "python3-setuptools"
        }
    ]
}

Ubuntu:Pro:16.04:LTS / python-pip

Package

Name: python-pip
Purl: pkg:deb/ubuntu/python-pip?arch=src?distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.1.1-2ubuntu0.6+esm8

Affected versions

1.*

1.5.6-7ubuntu1

1.5.6-7ubuntu2

8.*

8.0.2-7

8.0.3-1

8.0.3-2

8.1.0-1

8.1.0-2

8.1.1-1

8.1.1-2

8.1.1-2ubuntu0.1

8.1.1-2ubuntu0.2

8.1.1-2ubuntu0.4

8.1.1-2ubuntu0.6

8.1.1-2ubuntu0.6+esm2

8.1.1-2ubuntu0.6+esm3

8.1.1-2ubuntu0.6+esm4

8.1.1-2ubuntu0.6+esm5

8.1.1-2ubuntu0.6+esm6

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "8.1.1-2ubuntu0.6+esm8",
            "binary_name": "python-pip"
        },
        {
            "binary_version": "8.1.1-2ubuntu0.6+esm8",
            "binary_name": "python-pip-whl"
        },
        {
            "binary_version": "8.1.1-2ubuntu0.6+esm8",
            "binary_name": "python3-pip"
        }
    ]
}

Ubuntu:Pro:18.04:LTS / python-setuptools

Package

Name: python-setuptools
Purl: pkg:deb/ubuntu/python-setuptools?arch=src?distro=esm-infra/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

39.0.1-2ubuntu0.1+esm1

Affected versions

36.*

36.2.7-2

38.*

38.4.0-1

38.5.2-1

39.*

39.0.1-1

39.0.1-2

39.0.1-2ubuntu0.1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "39.0.1-2ubuntu0.1+esm1",
            "binary_name": "pypy-pkg-resources"
        },
        {
            "binary_version": "39.0.1-2ubuntu0.1+esm1",
            "binary_name": "pypy-setuptools"
        },
        {
            "binary_version": "39.0.1-2ubuntu0.1+esm1",
            "binary_name": "python-pkg-resources"
        },
        {
            "binary_version": "39.0.1-2ubuntu0.1+esm1",
            "binary_name": "python-setuptools"
        },
        {
            "binary_version": "39.0.1-2ubuntu0.1+esm1",
            "binary_name": "python-setuptools-doc"
        },
        {
            "binary_version": "39.0.1-2ubuntu0.1+esm1",
            "binary_name": "python3-pkg-resources"
        },
        {
            "binary_version": "39.0.1-2ubuntu0.1+esm1",
            "binary_name": "python3-setuptools"
        }
    ]
}

Ubuntu:Pro:18.04:LTS / python-pip

Package

Name: python-pip
Purl: pkg:deb/ubuntu/python-pip?arch=src?distro=esm-apps/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

9.0.1-2.3~ubuntu1.18.04.8+esm4

Affected versions

9.*

9.0.1-2

9.0.1-2.3~ubuntu1

9.0.1-2.3~ubuntu1.18.04.1

9.0.1-2.3~ubuntu1.18.04.2

9.0.1-2.3~ubuntu1.18.04.3

9.0.1-2.3~ubuntu1.18.04.4

9.0.1-2.3~ubuntu1.18.04.5

9.0.1-2.3~ubuntu1.18.04.5+esm2

9.0.1-2.3~ubuntu1.18.04.5+esm3

9.0.1-2.3~ubuntu1.18.04.6

9.0.1-2.3~ubuntu1.18.04.6+esm1

9.0.1-2.3~ubuntu1.18.04.7

9.0.1-2.3~ubuntu1.18.04.7+esm1

9.0.1-2.3~ubuntu1.18.04.8

9.0.1-2.3~ubuntu1.18.04.8+esm1

9.0.1-2.3~ubuntu1.18.04.8+esm2

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "9.0.1-2.3~ubuntu1.18.04.8+esm4",
            "binary_name": "python-pip"
        },
        {
            "binary_version": "9.0.1-2.3~ubuntu1.18.04.8+esm4",
            "binary_name": "python-pip-whl"
        },
        {
            "binary_version": "9.0.1-2.3~ubuntu1.18.04.8+esm4",
            "binary_name": "python3-pip"
        }
    ]
}

Ubuntu:20.04:LTS / python-pip

Package

Name: python-pip
Purl: pkg:deb/ubuntu/python-pip?arch=src?distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

18.*

18.1-5

18.1-5build1

18.1-5ubuntu1

20.*

20.0.2-2

20.0.2-4

20.0.2-5

20.0.2-5ubuntu1

20.0.2-5ubuntu1.1

20.0.2-5ubuntu1.3

20.0.2-5ubuntu1.4

20.0.2-5ubuntu1.5

20.0.2-5ubuntu1.6

20.0.2-5ubuntu1.7

20.0.2-5ubuntu1.8

20.0.2-5ubuntu1.9

20.0.2-5ubuntu1.10

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:20.04:LTS / python-setuptools

Package

Name: python-setuptools
Purl: pkg:deb/ubuntu/python-setuptools?arch=src?distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

41.*

41.1.0-1

41.4.0-1

44.*

44.0.0-1

44.0.0-2

44.0.0-2ubuntu0.1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:20.04:LTS / setuptools

Package

Name: setuptools
Purl: pkg:deb/ubuntu/setuptools?arch=src?distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

45.2.0-1ubuntu0.2

Affected versions

45.*

45.2.0-1

45.2.0-1ubuntu0.1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "45.2.0-1ubuntu0.2",
            "binary_name": "python-setuptools-doc"
        },
        {
            "binary_version": "45.2.0-1ubuntu0.2",
            "binary_name": "python3-pkg-resources"
        },
        {
            "binary_version": "45.2.0-1ubuntu0.2",
            "binary_name": "python3-setuptools"
        }
    ]
}

Ubuntu:Pro:20.04:LTS / python-pip

Package

Name: python-pip
Purl: pkg:deb/ubuntu/python-pip?arch=src?distro=esm-apps/focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

20.0.2-5ubuntu1.10+esm2

Affected versions

18.*

18.1-5

18.1-5build1

18.1-5ubuntu1

20.*

20.0.2-2

20.0.2-4

20.0.2-5

20.0.2-5ubuntu1

20.0.2-5ubuntu1.1

20.0.2-5ubuntu1.3

20.0.2-5ubuntu1.4

20.0.2-5ubuntu1.5

20.0.2-5ubuntu1.6

20.0.2-5ubuntu1.7

20.0.2-5ubuntu1.8

20.0.2-5ubuntu1.9

20.0.2-5ubuntu1.10

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "20.0.2-5ubuntu1.10+esm2",
            "binary_name": "python-pip-whl"
        },
        {
            "binary_version": "20.0.2-5ubuntu1.10+esm2",
            "binary_name": "python3-pip"
        }
    ]
}

Ubuntu:Pro:20.04:LTS / python-setuptools

Package

Name: python-setuptools
Purl: pkg:deb/ubuntu/python-setuptools?arch=src?distro=esm-apps/focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

44.0.0-2ubuntu0.1+esm1

Affected versions

41.*

41.1.0-1

41.4.0-1

44.*

44.0.0-1

44.0.0-2

44.0.0-2ubuntu0.1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "44.0.0-2ubuntu0.1+esm1",
            "binary_name": "pypy-pkg-resources"
        },
        {
            "binary_version": "44.0.0-2ubuntu0.1+esm1",
            "binary_name": "pypy-setuptools"
        },
        {
            "binary_version": "44.0.0-2ubuntu0.1+esm1",
            "binary_name": "python-pkg-resources"
        },
        {
            "binary_version": "44.0.0-2ubuntu0.1+esm1",
            "binary_name": "python-setuptools"
        }
    ]
}

Ubuntu:22.04:LTS / python-pip

Package

Name: python-pip
Purl: pkg:deb/ubuntu/python-pip?arch=src?distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

22.0.2+dfsg-1ubuntu0.4

Affected versions

20.*

20.3.4-4

21.*

21.3.1+dfsg-3

22.*

22.0.2+dfsg-1

22.0.2+dfsg-1ubuntu0.1

22.0.2+dfsg-1ubuntu0.2

22.0.2+dfsg-1ubuntu0.3

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "22.0.2+dfsg-1ubuntu0.4",
            "binary_name": "python3-pip"
        },
        {
            "binary_version": "22.0.2+dfsg-1ubuntu0.4",
            "binary_name": "python3-pip-whl"
        }
    ]
}

Ubuntu:22.04:LTS / python-setuptools

Package

Name: python-setuptools
Purl: pkg:deb/ubuntu/python-setuptools?arch=src?distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

44.*

44.1.1-1

44.1.1-1.2

44.1.1-1.2ubuntu0.22.04.1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:22.04:LTS / setuptools

Package

Name: setuptools
Purl: pkg:deb/ubuntu/setuptools?arch=src?distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

59.6.0-1.2ubuntu0.22.04.2

Affected versions

52.*

52.0.0-4

58.*

58.2.0-1

59.*

59.6.0-1.2

59.6.0-1.2ubuntu0.22.04.1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "59.6.0-1.2ubuntu0.22.04.2",
            "binary_name": "python-setuptools-doc"
        },
        {
            "binary_version": "59.6.0-1.2ubuntu0.22.04.2",
            "binary_name": "python3-pkg-resources"
        },
        {
            "binary_version": "59.6.0-1.2ubuntu0.22.04.2",
            "binary_name": "python3-setuptools"
        },
        {
            "binary_version": "59.6.0-1.2ubuntu0.22.04.2",
            "binary_name": "python3-setuptools-whl"
        }
    ]
}

Ubuntu:Pro:22.04:LTS / python-setuptools

Package

Name: python-setuptools
Purl: pkg:deb/ubuntu/python-setuptools?arch=src?distro=esm-apps/jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

44.1.1-1.2ubuntu0.22.04.1+esm1

Affected versions

44.*

44.1.1-1

44.1.1-1.2

44.1.1-1.2ubuntu0.22.04.1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "44.1.1-1.2ubuntu0.22.04.1+esm1",
            "binary_name": "pypy-pkg-resources"
        },
        {
            "binary_version": "44.1.1-1.2ubuntu0.22.04.1+esm1",
            "binary_name": "pypy-setuptools"
        },
        {
            "binary_version": "44.1.1-1.2ubuntu0.22.04.1+esm1",
            "binary_name": "python-pkg-resources"
        },
        {
            "binary_version": "44.1.1-1.2ubuntu0.22.04.1+esm1",
            "binary_name": "python-setuptools"
        },
        {
            "binary_version": "44.1.1-1.2ubuntu0.22.04.1+esm1",
            "binary_name": "python2-setuptools-whl"
        }
    ]
}

Ubuntu:24.10 / python-pip

Package

Name: python-pip
Purl: pkg:deb/ubuntu/python-pip?arch=src?distro=oracular

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

24.2+dfsg-1

Affected versions

24.*

24.0+dfsg-1ubuntu1

24.0+dfsg-2

24.1+dfsg-1

24.1.1+dfsg-1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "24.2+dfsg-1",
            "binary_name": "python3-pip"
        },
        {
            "binary_version": "24.2+dfsg-1",
            "binary_name": "python3-pip-whl"
        }
    ]
}

Ubuntu:24.10 / setuptools

Package

Name: setuptools
Purl: pkg:deb/ubuntu/setuptools?arch=src?distro=oracular

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

74.1.2-1

Affected versions

68.*

68.1.2-2ubuntu1

70.*

70.3.0-2

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "74.1.2-1",
            "binary_name": "python-setuptools-doc"
        },
        {
            "binary_version": "74.1.2-1",
            "binary_name": "python3-pkg-resources"
        },
        {
            "binary_version": "74.1.2-1",
            "binary_name": "python3-setuptools"
        },
        {
            "binary_version": "74.1.2-1",
            "binary_name": "python3-setuptools-whl"
        }
    ]
}

Ubuntu:24.04:LTS / python-pip

Package

Name: python-pip
Purl: pkg:deb/ubuntu/python-pip?arch=src?distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

24.0+dfsg-1ubuntu1

Affected versions

23.*

23.2+dfsg-1

23.3+dfsg-1

24.*

24.0+dfsg-1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "24.0+dfsg-1ubuntu1",
            "binary_name": "python3-pip"
        },
        {
            "binary_version": "24.0+dfsg-1ubuntu1",
            "binary_name": "python3-pip-whl"
        }
    ]
}

Ubuntu:24.04:LTS / setuptools

Package

Name: setuptools
Purl: pkg:deb/ubuntu/setuptools?arch=src?distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

68.1.2-2ubuntu1.1

Affected versions

68.*

68.1.2-2

68.1.2-2ubuntu1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "68.1.2-2ubuntu1.1",
            "binary_name": "python-setuptools-doc"
        },
        {
            "binary_version": "68.1.2-2ubuntu1.1",
            "binary_name": "python3-pkg-resources"
        },
        {
            "binary_version": "68.1.2-2ubuntu1.1",
            "binary_name": "python3-setuptools"
        },
        {
            "binary_version": "68.1.2-2ubuntu1.1",
            "binary_name": "python3-setuptools-whl"
        }
    ]
}