USN-7002-1: Setuptools vulnerability

Publication date

12 September 2024

Overview

setuptools could be made to crash or run programs if it received specially crafted network traffic.

Releases

Packages

It was discovered that setuptools was vulnerable to remote code
execution. An attacker could possibly use this issue to execute arbitrary
code.

In general, a standard system update will make all the necessary changes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release	Package Version
24.04 noble	python3-setuptools – 68.1.2-2ubuntu1.1
22.04 jammy	pypy-setuptools – 44.1.1-1.2ubuntu0.22.04.1+esm1
	python-setuptools – 44.1.1-1.2ubuntu0.22.04.1+esm1
	python3-setuptools – 59.6.0-1.2ubuntu0.22.04.2
20.04 focal	pypy-setuptools – 44.0.0-2ubuntu0.1+esm1
	python-setuptools – 44.0.0-2ubuntu0.1+esm1
	python3-setuptools – 45.2.0-1ubuntu0.2
18.04 bionic	pypy-setuptools – 39.0.1-2ubuntu0.1+esm1
	python-setuptools – 39.0.1-2ubuntu0.1+esm1
	python3-setuptools – 39.0.1-2ubuntu0.1+esm1
16.04 xenial	pypy-setuptools – 20.7.0-1ubuntu0.1~esm2
	python-setuptools – 20.7.0-1ubuntu0.1~esm2
	python3-setuptools – 20.7.0-1ubuntu0.1~esm2
14.04 trusty	python-setuptools – 3.3-1ubuntu2+esm2
14.04 trusty	python3-setuptools – 3.3-1ubuntu2+esm2

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro