USN-7544-1

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/notices/USN-7544-1

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-7544-1.json

JSON Data

https://api.test.osv.dev/v1/vulns/USN-7544-1

Related

Published

2025-05-28T19:34:54.828991Z

Modified

2025-05-28T19:34:54.828991Z

Summary

python-setuptools, setuptools vulnerability

Details

It was discovered that setuptools did not properly sanitize paths. An attacker could possibly use this issue to write files to arbitrary locations on the filesystem.

References

Affected packages

Ubuntu:Pro:14.04:LTS / python-setuptools

Package

Name: python-setuptools
Purl: pkg:deb/ubuntu/python-setuptools@3.3-1ubuntu2+esm3?arch=source&distro=esm-infra-legacy/trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.3-1ubuntu2+esm3

Affected versions

1.*

1.4.2-1

2.*

2.0.1-1ubuntu1

2.0.1-2ubuntu1

2.0.2-1

2.1-1

2.2-1

3.*

3.3-1ubuntu1

3.3-1ubuntu2

3.3-1ubuntu2+esm1

3.3-1ubuntu2+esm2

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_version": "3.3-1ubuntu2+esm3",
            "binary_name": "python-pkg-resources"
        },
        {
            "binary_version": "3.3-1ubuntu2+esm3",
            "binary_name": "python-setuptools"
        },
        {
            "binary_version": "3.3-1ubuntu2+esm3",
            "binary_name": "python-setuptools-doc"
        },
        {
            "binary_version": "3.3-1ubuntu2+esm3",
            "binary_name": "python-setuptools-whl"
        },
        {
            "binary_version": "3.3-1ubuntu2+esm3",
            "binary_name": "python3-pkg-resources"
        },
        {
            "binary_version": "3.3-1ubuntu2+esm3",
            "binary_name": "python3-setuptools"
        }
    ]
}

Ubuntu:Pro:16.04:LTS / python-setuptools

Package

Name: python-setuptools
Purl: pkg:deb/ubuntu/python-setuptools@20.7.0-1ubuntu0.1~esm3?arch=source&distro=esm-infra/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

20.7.0-1ubuntu0.1~esm3

Affected versions

18.*

18.4-1

18.4-2

18.7-1

18.8-1

20.*

20.1.1-1

20.3.1-1

20.7.0-1

20.7.0-1ubuntu0.1~esm1

20.7.0-1ubuntu0.1~esm2

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_version": "20.7.0-1ubuntu0.1~esm3",
            "binary_name": "pypy-pkg-resources"
        },
        {
            "binary_version": "20.7.0-1ubuntu0.1~esm3",
            "binary_name": "pypy-setuptools"
        },
        {
            "binary_version": "20.7.0-1ubuntu0.1~esm3",
            "binary_name": "python-pkg-resources"
        },
        {
            "binary_version": "20.7.0-1ubuntu0.1~esm3",
            "binary_name": "python-setuptools"
        },
        {
            "binary_version": "20.7.0-1ubuntu0.1~esm3",
            "binary_name": "python-setuptools-doc"
        },
        {
            "binary_version": "20.7.0-1ubuntu0.1~esm3",
            "binary_name": "python3-pkg-resources"
        },
        {
            "binary_version": "20.7.0-1ubuntu0.1~esm3",
            "binary_name": "python3-setuptools"
        }
    ]
}

Ubuntu:Pro:18.04:LTS / python-setuptools

Package

Name: python-setuptools
Purl: pkg:deb/ubuntu/python-setuptools@39.0.1-2ubuntu0.1+esm2?arch=source&distro=esm-infra/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

39.0.1-2ubuntu0.1+esm2

Affected versions

36.*

36.2.7-2

38.*

38.4.0-1

38.5.2-1

39.*

39.0.1-1

39.0.1-2

39.0.1-2ubuntu0.1

39.0.1-2ubuntu0.1+esm1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_version": "39.0.1-2ubuntu0.1+esm2",
            "binary_name": "pypy-pkg-resources"
        },
        {
            "binary_version": "39.0.1-2ubuntu0.1+esm2",
            "binary_name": "pypy-setuptools"
        },
        {
            "binary_version": "39.0.1-2ubuntu0.1+esm2",
            "binary_name": "python-pkg-resources"
        },
        {
            "binary_version": "39.0.1-2ubuntu0.1+esm2",
            "binary_name": "python-setuptools"
        },
        {
            "binary_version": "39.0.1-2ubuntu0.1+esm2",
            "binary_name": "python-setuptools-doc"
        },
        {
            "binary_version": "39.0.1-2ubuntu0.1+esm2",
            "binary_name": "python3-pkg-resources"
        },
        {
            "binary_version": "39.0.1-2ubuntu0.1+esm2",
            "binary_name": "python3-setuptools"
        }
    ]
}

Ubuntu:20.04:LTS / setuptools

Package

Name: setuptools
Purl: pkg:deb/ubuntu/setuptools@45.2.0-1ubuntu0.3?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

45.2.0-1ubuntu0.3

Affected versions

45.*

45.2.0-1

45.2.0-1ubuntu0.1

45.2.0-1ubuntu0.2

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "45.2.0-1ubuntu0.3",
            "binary_name": "python-setuptools-doc"
        },
        {
            "binary_version": "45.2.0-1ubuntu0.3",
            "binary_name": "python3-pkg-resources"
        },
        {
            "binary_version": "45.2.0-1ubuntu0.3",
            "binary_name": "python3-setuptools"
        }
    ]
}

Ubuntu:Pro:20.04:LTS / python-setuptools

Package

Name: python-setuptools
Purl: pkg:deb/ubuntu/python-setuptools@44.0.0-2ubuntu0.1+esm2?arch=source&distro=esm-apps/focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

44.0.0-2ubuntu0.1+esm2

Affected versions

41.*

41.1.0-1

41.4.0-1

44.*

44.0.0-1

44.0.0-2

44.0.0-2ubuntu0.1

44.0.0-2ubuntu0.1+esm1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_version": "44.0.0-2ubuntu0.1+esm2",
            "binary_name": "pypy-pkg-resources"
        },
        {
            "binary_version": "44.0.0-2ubuntu0.1+esm2",
            "binary_name": "pypy-setuptools"
        },
        {
            "binary_version": "44.0.0-2ubuntu0.1+esm2",
            "binary_name": "python-pkg-resources"
        },
        {
            "binary_version": "44.0.0-2ubuntu0.1+esm2",
            "binary_name": "python-setuptools"
        }
    ]
}

Ubuntu:22.04:LTS / setuptools

Package

Name: setuptools
Purl: pkg:deb/ubuntu/setuptools@59.6.0-1.2ubuntu0.22.04.3?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

59.6.0-1.2ubuntu0.22.04.3

Affected versions

52.*

52.0.0-4

58.*

58.2.0-1

59.*

59.6.0-1.2

59.6.0-1.2ubuntu0.22.04.1

59.6.0-1.2ubuntu0.22.04.2

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "59.6.0-1.2ubuntu0.22.04.3",
            "binary_name": "python-setuptools-doc"
        },
        {
            "binary_version": "59.6.0-1.2ubuntu0.22.04.3",
            "binary_name": "python3-pkg-resources"
        },
        {
            "binary_version": "59.6.0-1.2ubuntu0.22.04.3",
            "binary_name": "python3-setuptools"
        },
        {
            "binary_version": "59.6.0-1.2ubuntu0.22.04.3",
            "binary_name": "python3-setuptools-whl"
        }
    ]
}

Ubuntu:Pro:22.04:LTS / python-setuptools

Package

Name: python-setuptools
Purl: pkg:deb/ubuntu/python-setuptools@44.1.1-1.2ubuntu0.22.04.1+esm2?arch=source&distro=esm-apps/jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

44.1.1-1.2ubuntu0.22.04.1+esm2

Affected versions

44.*

44.1.1-1

44.1.1-1.2

44.1.1-1.2ubuntu0.22.04.1

44.1.1-1.2ubuntu0.22.04.1+esm1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_version": "44.1.1-1.2ubuntu0.22.04.1+esm2",
            "binary_name": "pypy-pkg-resources"
        },
        {
            "binary_version": "44.1.1-1.2ubuntu0.22.04.1+esm2",
            "binary_name": "pypy-setuptools"
        },
        {
            "binary_version": "44.1.1-1.2ubuntu0.22.04.1+esm2",
            "binary_name": "python-pkg-resources"
        },
        {
            "binary_version": "44.1.1-1.2ubuntu0.22.04.1+esm2",
            "binary_name": "python-setuptools"
        },
        {
            "binary_version": "44.1.1-1.2ubuntu0.22.04.1+esm2",
            "binary_name": "python2-setuptools-whl"
        }
    ]
}

Ubuntu:24.10 / setuptools

Package

Name: setuptools
Purl: pkg:deb/ubuntu/setuptools@74.1.2-1ubuntu0.1?arch=source&distro=oracular

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

74.1.2-1ubuntu0.1

Affected versions

68.*

68.1.2-2ubuntu1

70.*

70.3.0-2

74.*

74.1.2-1

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "74.1.2-1ubuntu0.1",
            "binary_name": "python-setuptools-doc"
        },
        {
            "binary_version": "74.1.2-1ubuntu0.1",
            "binary_name": "python3-pkg-resources"
        },
        {
            "binary_version": "74.1.2-1ubuntu0.1",
            "binary_name": "python3-setuptools"
        },
        {
            "binary_version": "74.1.2-1ubuntu0.1",
            "binary_name": "python3-setuptools-whl"
        }
    ]
}

Ubuntu:24.04:LTS / setuptools

Package

Name: setuptools
Purl: pkg:deb/ubuntu/setuptools@68.1.2-2ubuntu1.2?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

68.1.2-2ubuntu1.2

Affected versions

68.*

68.1.2-2

68.1.2-2ubuntu1

68.1.2-2ubuntu1.1

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "68.1.2-2ubuntu1.2",
            "binary_name": "python-setuptools-doc"
        },
        {
            "binary_version": "68.1.2-2ubuntu1.2",
            "binary_name": "python3-pkg-resources"
        },
        {
            "binary_version": "68.1.2-2ubuntu1.2",
            "binary_name": "python3-setuptools"
        },
        {
            "binary_version": "68.1.2-2ubuntu1.2",
            "binary_name": "python3-setuptools-whl"
        }
    ]
}

Ubuntu:25.04 / setuptools

Package

Name: setuptools
Purl: pkg:deb/ubuntu/setuptools@75.8.0-1ubuntu1?arch=source&distro=plucky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

75.8.0-1ubuntu1

Affected versions

74.*

74.1.2-1

75.*

75.2.0-1

75.6.0-1

75.8.0-1

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "75.8.0-1ubuntu1",
            "binary_name": "python-setuptools-doc"
        },
        {
            "binary_version": "75.8.0-1ubuntu1",
            "binary_name": "python3-pkg-resources"
        },
        {
            "binary_version": "75.8.0-1ubuntu1",
            "binary_name": "python3-setuptools"
        },
        {
            "binary_version": "75.8.0-1ubuntu1",
            "binary_name": "python3-setuptools-whl"
        }
    ]
}