{"id":"CVE-2024-6345","title":"pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools (CVE-2024-6345)","summary":"A flaw was found in the package_index module of pypa/setuptools. Affected versions of this package allow remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or …","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssSource":"vendor","cwe":"CWE-94","vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream (v. 8)","affected":["multiarch_tuning_operator","ansible_automation_platform 2","ceph_storage 7","enterprise_linux 6","enterprise_linux 8","enterprise_linux 9","openshift_ai_rhoai","openshift_container_platform 4","openshift_data_science_rhods","enterprise_linux_server_v_7_els","quay v3","openshift_dev_spaces 3","developer_hub_1_2_for_rhel 9","openshift_container_platform 4.17","9base_service_interconnect_1_4","service_interconnect 1","enterprise_linux_appstream_v_8","enterprise_linux_appstream_aus_v_8_4","enterprise_linux_appstream_e4s_v_8_4","enterprise_linux_appstream_tus_v_8_4","enterprise_linux_appstream_aus_v_8_6","enterprise_linux_appstream_e4s_v_8_6","enterprise_linux_appstream_tus_v_8_6","enterprise_linux_appstream_eus_v_8_8","enterprise_linux_appstream_e4s_v_9_0","enterprise_linux_appstream_eus_v_9_2","enterprise_linux_appstream_v_9","enterprise_linux_baseos_v_8","enterprise_linux_baseos_aus_v_8_2","enterprise_linux_baseos_aus_v_8_4","enterprise_linux_baseos_e4s_v_8_4","enterprise_linux_baseos_tus_v_8_4","enterprise_linux_baseos_aus_v_8_6","enterprise_linux_baseos_e4s_v_8_6","enterprise_linux_baseos_tus_v_8_6","enterprise_linux_baseos_eus_v_8_8","enterprise_linux_baseos_e4s_v_9_0","enterprise_linux_baseos_eus_v_9_2","enterprise_linux_baseos_v_9","enterprise_linux_crb_v_8"],"patched":["enterprise_linux_server_v_7_els","quay v3","openshift_dev_spaces 3","developer_hub_1_2_for_rhel 9","openshift_container_platform 4.17","9base_service_interconnect_1_4","service_interconnect 1","enterprise_linux_appstream_v_8","enterprise_linux_appstream_aus_v_8_4","enterprise_linux_appstream_e4s_v_8_4","enterprise_linux_appstream_tus_v_8_4","enterprise_linux_appstream_aus_v_8_6","enterprise_linux_appstream_e4s_v_8_6","enterprise_linux_appstream_tus_v_8_6","enterprise_linux_appstream_eus_v_8_8","enterprise_linux_appstream_e4s_v_9_0","enterprise_linux_appstream_eus_v_9_2","enterprise_linux_appstream_v_9","enterprise_linux_baseos_v_8","enterprise_linux_baseos_aus_v_8_2","enterprise_linux_baseos_aus_v_8_4","enterprise_linux_baseos_e4s_v_8_4","enterprise_linux_baseos_tus_v_8_4","enterprise_linux_baseos_aus_v_8_6","enterprise_linux_baseos_e4s_v_8_6","enterprise_linux_baseos_tus_v_8_6","enterprise_linux_baseos_eus_v_8_8","enterprise_linux_baseos_e4s_v_9_0","enterprise_linux_baseos_eus_v_9_2","enterprise_linux_baseos_v_9","enterprise_linux_crb_v_8","codeready_linux_builder_eus_v_8_8","enterprise_linux_crb_v_9","enterprise_linux_highavailability_v_8","enterprise_linux_high_availability_aus_v_8_4","enterprise_linux_highavailability_e4s_v_8_4","enterprise_linux_highavailability_tus_v_8_4","enterprise_linux_high_availability_e4s_v_8_6","enterprise_linux_high_availability_tus_v_8_6","enterprise_linux_high_availability_eus_v_8_8"],"published":"2024-07-15","updated":"2026-10-14","sourceUpdated":"2026-10-14T01:00:48+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-6345.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-6345.json"},{"url":"https://access.redhat.com/security/cve/CVE-2024-6345"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2297771"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-6345"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6345"},{"url":"https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0"},{"url":"https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5"},{"url":"https://access.redhat.com/errata/RHSA-2024:6662"},{"url":"https://access.redhat.com/errata/RHSA-2024:6661"},{"url":"https://access.redhat.com/errata/RHBA-2024:5039"},{"url":"https://access.redhat.com/errata/RHSA-2024:6667"},{"url":"https://access.redhat.com/errata/RHEA-2024:4071"},{"url":"https://access.redhat.com/errata/RHSA-2024:7922"},{"url":"https://access.redhat.com/errata/RHSA-2024:7213"},{"url":"https://access.redhat.com/errata/RHSA-2024:10135"},{"url":"https://access.redhat.com/errata/RHSA-2024:11109"},{"url":"https://access.redhat.com/errata/RHSA-2024:7374"},{"url":"https://access.redhat.com/errata/RHSA-2024:5962"},{"url":"https://access.redhat.com/errata/RHSA-2024:6309"},{"url":"https://access.redhat.com/errata/RHSA-2024:5532"},{"url":"https://access.redhat.com/errata/RHSA-2024:5531"},{"url":"https://access.redhat.com/errata/RHSA-2024:6488"},{"url":"https://access.redhat.com/errata/RHSA-2024:8170"},{"url":"https://access.redhat.com/errata/RHSA-2024:6220"},{"url":"https://access.redhat.com/errata/RHSA-2024:8171"},{"url":"https://access.redhat.com/errata/RHSA-2024:5084"},{"url":"https://access.redhat.com/errata/RHSA-2024:8168"},{"url":"https://access.redhat.com/errata/RHSA-2024:5002"},{"url":"https://access.redhat.com/errata/RHSA-2024:6612"},{"url":"https://access.redhat.com/errata/RHSA-2024:6611"},{"url":"https://github.com/pypa/setuptools/pull/4332"},{"url":"https://github.com/pypa/setuptools"},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.01939,"epssPercentile":0.80007,"aliases":["GHSA-cx63-2mw6-8hw5","BIT-setuptools-2024-6345","PYSEC-2026-1918"],"ecosystem":"pip","ingestedAt":"2026-07-08T18:25:48.607Z","slug":"CVE-2024-6345","body":"## Overview\n\nA flaw was found in the package_index module of pypa/setuptools. Affected versions of this package allow remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.\n\n## Vendor advisories\n\n- **RHSA-2024:6662** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS) · released 2024-09-13 · [advisory](https://access.redhat.com/errata/RHSA-2024:6662)\n- **RHSA-2024:6661** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS) · released 2024-09-12 · [advisory](https://access.redhat.com/errata/RHSA-2024:6661)\n- **RHBA-2024:5039** · Red Hat · fixed in: Quay v3 · released 2024-08-19 · [advisory](https://access.redhat.com/errata/RHBA-2024:5039)\n- **RHSA-2024:6667** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3 · released 2024-09-12 · [advisory](https://access.redhat.com/errata/RHSA-2024:6667)\n- **RHEA-2024:4071** · Red Hat · fixed in: Red Hat Developer Hub 1.2 for RHEL 9 · released 2024-06-24 · [advisory](https://access.redhat.com/errata/RHEA-2024:4071)\n- **RHSA-2024:7922** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.17 · released 2024-10-16 · [advisory](https://access.redhat.com/errata/RHSA-2024:7922)\n- **RHSA-2024:7213** · Red Hat · fixed in: 9Base-Service-Interconnect-1.4 · released 2024-09-26 · [advisory](https://access.redhat.com/errata/RHSA-2024:7213)\n- **RHSA-2024:10135** · Red Hat · fixed in: 9Base-Service-Interconnect-1.4 · released 2024-11-21 · [advisory](https://access.redhat.com/errata/RHSA-2024:10135)\n- **RHSA-2024:11109** · Red Hat · fixed in: Red Hat Service Interconnect 1 · released 2024-12-16 · [advisory](https://access.redhat.com/errata/RHSA-2024:11109)\n- **RHSA-2024:7374** · Red Hat · fixed in: Red Hat Service Interconnect 1 · released 2024-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2024:7374)\n- **RHSA-2024:5962** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2024-08-28 · [advisory](https://access.redhat.com/errata/RHSA-2024:5962)\n- **Red Hat VEX** · Important · affected: Multiarch Tuning Operator, Red Hat Ansible Automation Platform 2, Red Hat Ceph Storage 7, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8, Multiarch Tuning Operator, Red Hat Ansible Automation Platform 2, … · updated 2026-10-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-6345.json)\n\n**pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools** — rated Important by Red Hat. Released 2024-07-15, updated 2026-10-14.\n\nAffected:\n\n- Multiarch Tuning Operator\n- Red Hat Ansible Automation Platform 2\n- Red Hat Ceph Storage 7\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenShift Data Science (RHODS)\n\nFixed:\n\n- Red Hat Enterprise Linux Server (v. 7 ELS)\n- Quay v3\n- Red Hat OpenShift Dev Spaces 3\n- Red Hat Developer Hub 1.2 for RHEL 9\n- Red Hat OpenShift Container Platform 4.17\n- 9Base-Service-Interconnect-1.4\n- Red Hat Service Interconnect 1\n- Red Hat Enterprise Linux AppStream (v. 8)\n- Red Hat Enterprise Linux AppStream AUS (v.8.4)\n- Red Hat Enterprise Linux AppStream E4S (v.8.4)\n- Red Hat Enterprise Linux AppStream TUS (v.8.4)\n- Red Hat Enterprise Linux AppStream AUS (v.8.6)\n- Red Hat Enterprise Linux AppStream E4S (v.8.6)\n- Red Hat Enterprise Linux AppStream TUS (v.8.6)\n- Red Hat Enterprise Linux AppStream EUS (v.8.8)\n- Red Hat Enterprise Linux AppStream E4S (v.9.0)\n- Red Hat Enterprise Linux AppStream EUS (v.9.2)\n- Red Hat Enterprise Linux AppStream (v. 9)\n- Red Hat Enterprise Linux BaseOS (v. 8)\n- Red Hat Enterprise Linux BaseOS AUS (v. 8.2)\n- Red Hat Enterprise Linux BaseOS AUS (v.8.4)\n- Red Hat Enterprise Linux BaseOS E4S (v.8.4)\n- Red Hat Enterprise Linux BaseOS TUS (v.8.4)\n- Red Hat Enterprise Linux BaseOS AUS (v.8.6)\n- Red Hat Enterprise Linux BaseOS E4S (v.8.6)\n- Red Hat Enterprise Linux BaseOS TUS (v.8.6)\n- Red Hat Enterprise Linux BaseOS EUS (v.8.8)\n- Red Hat Enterprise Linux BaseOS E4S (v.9.0)\n- Red Hat Enterprise Linux BaseOS EUS (v.9.2)\n- Red Hat Enterprise Linux BaseOS (v. 9)\n- Red Hat Enterprise Linux CRB (v. 8)\n- Red Hat CodeReady Linux Builder EUS (v.8.8)\n- Red Hat Enterprise Linux CRB (v. 9)\n- Red Hat Enterprise Linux HighAvailability (v. 8)\n- Red Hat Enterprise Linux High Availability AUS (v.8.4)\n- Red Hat Enterprise Linux HighAvailability E4S (v.8.4)\n- Red Hat Enterprise Linux HighAvailability TUS (v.8.4)\n- Red Hat Enterprise Linux High Availability E4S (v.8.6)\n- Red Hat Enterprise Linux High Availability TUS (v.8.6)\n- Red Hat Enterprise Linux High Availability EUS (v.8.8)\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 8\n- Multiarch Tuning Operator\n- Red Hat Ansible Automation Platform 2\n- Red Hat Ceph Storage 7\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenShift Data Science (RHODS)\n\nNot affected:\n\n- Red Hat Developer Hub 1.2 for RHEL 9\n- Red Hat OpenShift Container Platform 4.17\n- Red Hat Ceph Storage 7.1\n- Logging Subsystem for Red Hat OpenShift\n- Red Hat Ansible Automation Platform 2\n- Red Hat Developer Hub\n- Red Hat Discovery 1\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2024:6662\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2024:6661\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHBA-2024:5039\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\n## Package advisory (CVE-2024-6345)\n\nAffected packages:\n\n- `setuptools < 70.0.0`\n\nPatched in:\n\n- `setuptools 70.0.0`\n\nSource: https://osv.dev/vulnerability/GHSA-cx63-2mw6-8hw5","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.4,"exploitation":0,"ransomware":0},"changes":[]}