Repository navigation
Update bundled setuptools provided by ensurepip in current 3.8.x through 3.11.x to include fix for CVE-2022-40897? #102202
Description
Activity
CVE-2022-40897 is a ReDoS in setuptools, fixed in setuptools 65.5.1 (released Nov 4, 2022):
The
3.9branch hassetuptools-58.1.0-py3-none-any.whl(Sep 22, 2021):The
mainbranch hassetuptools-65.5.0-py3-none-any.whl(Oct 14, 2022):
Before updating, Python 3.7-3.9 are security-fix only (https://devguide.python.org/versions/), let's first check with release managers @ambv and @ned-deily.
A quick check shows the CI passes for 3.9: https://github.com/hugovk/cpython/actions/runs/4260373632
- added a commit that references this issue
on Feb 24, 2023 - added a commit that references this issue
on Feb 26, 2023 Regarding backporting to 3.7, see my comment on the PR. In short, I don't want to backport this to 3.7 as the benefits are minimal and the risks are high.
Reacted by Hugo van Kemenade@hugovk @ned-deily So, the security should be fixed in 3.10-3.12. Correct?
So, the security should be fixed in 3.10-3.12. Correct?
Ultimately, it's up to the release managers for those releases but I expect they will be updated soon.
However, your original question seems to be about an Alpine docker image with python3.9. If so, you should check with the maintainer of that image. It should be a trivial matter to update the image with the new version of setuptools. Or you can just update it yourself when running the image by using some variant of:
python3.9 -m pip install --upgrade pip python3.9 -m pip install --upgrade setuptoolsA CPython update to
ensurepipby itself isn't going to make a difference to the Docker image.Reacted by Mohammad MesbahTo follow up on this, the current status is that we are still shipping various older versions of
setuptoolswithensurepipin Python 3.11 and 3.10 (65.5.0), 3.9 (58.1.0), and 3.8 (56.0.0). (We no longer includesetuptoolswithensurepipas of 3.12.) It should be up to the affected release managers to decide what action, if any, should be taken and then update and close this issue. Are there other potentially relevant security fixes insetuptools?- changed the title
[-][3.9] Any plan about fixing CVE-2022-40897 in python 3.9-alpine[/-][+]Update bundled setuptools provided by ensurepip in current 3.8.x through 3.11.x to include fix for CVE-2022-40897?[/+]on Dec 7, 2023 @ned-deily Beyond CVE-2022-40897 there aren't any additional vulnerabilities in setuptools. I don't think it's particularly bundersome to ask users to upgrade pip when using
ensurepipto bootstrap, pip itself will start issuing warnings about being out of date as well.In fact, could we make
ensurepipautomatically attempt to upgrade the installed pip during bootstrapping (ie set--upgradetoTrueby default?)? cc @pradyunsgIn fact, could we make
ensurepipautomatically attempt to upgrade the installed pip during bootstrapping (ie set--upgradetoTrueby default?)? cc @pradyunsgWe could but that approach was rejected in the original PEP proposing
ensurepip. That could be revisited.3 remaining items
Mark as release blocker for 3.8, 3.9, and 3.10 decisions.
@ned-deily Is there any tentative release date for the vulnerability fix? This issue came to us from our customer as high-priority issue.
Looking for some updates on this vulnerability patching, thanks!
So, a DoS can be caused by a package that's considered for download and installation (which can run arbitrary code), or by the site that serves such packages?
I don't see how this can be exploited without the attacker being able to do much more damage; a fix will mainly silence automated checkers.@sethmlarson, you have more info; let me know (possibly privately) if we need to fix this somehow.
Unfortunately, setuptools had breaking changes since 58.1 (and 65.5).
Back in my old job, I'd do a surgical patch to fix the regex only. Not sure if that's appropriate for CPython, but if we're distributing a library that's no longer supported upstream, it probably should be.@encukou I agree that there isn't much benefit to patching that CVE and it's only likely to cause breakages.
@samruddhikhandale @bhupendra-vaishnav As far as finding a solution to your issue, it seems that scanners are alerting regardless of whether that file is completely inert and useless in the image. Maybe a way forward is to ensure pip and setuptools are bootstrapped to versions that you're happy with (ie
python -m pip install --disable-version-check pip==... --hash=...; python -m pip install setuptools==... --hash=...) and then theLib/ensurepip/_bundled/...directory can be deleted entirely?Lib/ensurepip/_bundled/... directory can be deleted entirely?
We tried deleting the directory, but then
pipfails to work 😓 Hence, we are not able to patch it on our end.Maybe a way forward is to ensure pip and setuptools are bootstrapped to versions that you're happy with
Yep, we already have that logic added, thanks!
the Lib/ensurepip/_bundled/... directory can be deleted entirely?
IIUC, this will break ensurepip, which breaks venv since venv relies on ensurepip to install a copy of pip (and setuptools) in the environment.
Reacted by Samruddhi KhandaleNote that you can run
venvwith--no-pip, and then install pip separately.
If you redistribute Python, you could try to replace the wheels and adjust the version numbers inLib/ensurepip/__init__.py. (And test that the incompatibilities in the new versions don't affect you, of course.)I agree that there isn't much benefit to patching that CVE and it's only likely to cause breakages.
With that, let's close. It's not a notable security vulnerability in Python. Telling that to your security scanner is, in this case, up to you.
@ambv @pablogsal, please tell me if I'm out of line and I should have left this decision to you.
Reacted by Pradyun Gedam and Łukasz Langa- moved this from Todo to Done in Release and Deferred blockers 🚫
on Feb 9, 2024 - marked Update bundled setuptools to address CVE-2024-6345, CVE-2022-40897 in cpython 3.9, 3.10 & 3.11 #131864 as a duplicate of this issue
on Apr 1, 2025 @encukou @ambv @pablogsal what about vulnerability https://nvd.nist.gov/vuln/detail/CVE-2024-6345 which was mentioned #131864 ?
Just found the image are impacted. Any fix plan?
GHSA-r9hx-vwmv-q579
Linked PRs