Overview
A flaw was found in the package_index module of pypa/setuptools. Affected versions of this package allow remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
Vendor advisories
- RHSA-2024:6662 · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS) · released 2024-09-13 · advisory
- RHSA-2024:6661 · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS) · released 2024-09-12 · advisory
- RHBA-2024:5039 · Red Hat · fixed in: Quay v3 · released 2024-08-19 · advisory
- RHSA-2024:6667 · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3 · released 2024-09-12 · advisory
- RHEA-2024:4071 · Red Hat · fixed in: Red Hat Developer Hub 1.2 for RHEL 9 · released 2024-06-24 · advisory
- RHSA-2024:7922 · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.17 · released 2024-10-16 · advisory
- RHSA-2024:7213 · Red Hat · fixed in: 9Base-Service-Interconnect-1.4 · released 2024-09-26 · advisory
- RHSA-2024:10135 · Red Hat · fixed in: 9Base-Service-Interconnect-1.4 · released 2024-11-21 · advisory
- RHSA-2024:11109 · Red Hat · fixed in: Red Hat Service Interconnect 1 · released 2024-12-16 · advisory
- RHSA-2024:7374 · Red Hat · fixed in: Red Hat Service Interconnect 1 · released 2024-09-30 · advisory
- RHSA-2024:5962 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2024-08-28 · advisory
- Red Hat VEX · Important · affected: Multiarch Tuning Operator, Red Hat Ansible Automation Platform 2, Red Hat Ceph Storage 7, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8, Multiarch Tuning Operator, Red Hat Ansible Automation Platform 2, … · updated 2026-10-14 · vex
pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools — rated Important by Red Hat. Released 2024-07-15, updated 2026-10-14.
Affected:
- Multiarch Tuning Operator
- Red Hat Ansible Automation Platform 2
- Red Hat Ceph Storage 7
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Data Science (RHODS)
Fixed:
- Red Hat Enterprise Linux Server (v. 7 ELS)
- Quay v3
- Red Hat OpenShift Dev Spaces 3
- Red Hat Developer Hub 1.2 for RHEL 9
- Red Hat OpenShift Container Platform 4.17
- 9Base-Service-Interconnect-1.4
- Red Hat Service Interconnect 1
- Red Hat Enterprise Linux AppStream (v. 8)
- Red Hat Enterprise Linux AppStream AUS (v.8.4)
- Red Hat Enterprise Linux AppStream E4S (v.8.4)
- Red Hat Enterprise Linux AppStream TUS (v.8.4)
- Red Hat Enterprise Linux AppStream AUS (v.8.6)
- Red Hat Enterprise Linux AppStream E4S (v.8.6)
- Red Hat Enterprise Linux AppStream TUS (v.8.6)
- Red Hat Enterprise Linux AppStream EUS (v.8.8)
- Red Hat Enterprise Linux AppStream E4S (v.9.0)
- Red Hat Enterprise Linux AppStream EUS (v.9.2)
- Red Hat Enterprise Linux AppStream (v. 9)
- Red Hat Enterprise Linux BaseOS (v. 8)
- Red Hat Enterprise Linux BaseOS AUS (v. 8.2)
- Red Hat Enterprise Linux BaseOS AUS (v.8.4)
- Red Hat Enterprise Linux BaseOS E4S (v.8.4)
- Red Hat Enterprise Linux BaseOS TUS (v.8.4)
- Red Hat Enterprise Linux BaseOS AUS (v.8.6)
- Red Hat Enterprise Linux BaseOS E4S (v.8.6)
- Red Hat Enterprise Linux BaseOS TUS (v.8.6)
- Red Hat Enterprise Linux BaseOS EUS (v.8.8)
- Red Hat Enterprise Linux BaseOS E4S (v.9.0)
- Red Hat Enterprise Linux BaseOS EUS (v.9.2)
- Red Hat Enterprise Linux BaseOS (v. 9)
- Red Hat Enterprise Linux CRB (v. 8)
- Red Hat CodeReady Linux Builder EUS (v.8.8)
- Red Hat Enterprise Linux CRB (v. 9)
- Red Hat Enterprise Linux HighAvailability (v. 8)
- Red Hat Enterprise Linux High Availability AUS (v.8.4)
- Red Hat Enterprise Linux HighAvailability E4S (v.8.4)
- Red Hat Enterprise Linux HighAvailability TUS (v.8.4)
- Red Hat Enterprise Linux High Availability E4S (v.8.6)
- Red Hat Enterprise Linux High Availability TUS (v.8.6)
- Red Hat Enterprise Linux High Availability EUS (v.8.8)
No fix planned:
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 8
- Multiarch Tuning Operator
- Red Hat Ansible Automation Platform 2
- Red Hat Ceph Storage 7
- Red Hat Enterprise Linux 9
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Data Science (RHODS)
Not affected:
- Red Hat Developer Hub 1.2 for RHEL 9
- Red Hat OpenShift Container Platform 4.17
- Red Hat Ceph Storage 7.1
- Logging Subsystem for Red Hat OpenShift
- Red Hat Ansible Automation Platform 2
- Red Hat Developer Hub
- Red Hat Discovery 1
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
Remediation
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2024:6662
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2024:6661
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHBA-2024:5039
Workarounds / mitigations:
- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Package advisory (CVE-2024-6345)
Affected packages:
Patched in:
Source: https://osv.dev/vulnerability/GHSA-cx63-2mw6-8hw5