AZL-43326

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-43326.json

JSON Data

https://api.test.osv.dev/v1/vulns/AZL-43326

Upstream

CVE-2024-6345

Published

2024-07-15T01:15:01Z

Modified

2026-04-01T05:15:04.195463Z

Summary

CVE-2024-6345 affecting package python-pip for versions less than 24.2-1

Details

A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-6345

Affected packages

Azure Linux:3 / python-pip

Package

Name: python-pip
Purl: pkg:rpm/azure-linux/python-pip

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

24.2-1

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-43326.json"