Path Traversal Vulnerability in setuptools PackageIndex
CVE: CVE-2025-47273
Component: setuptools
CWE: CWE-22
Severity: Moderate
CVSS v3: 7.3/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Release date: 2025-05-17T15:46:11.399000+00:00

A path traversal vulnerability in the Python setuptools library allows attackers with limited system access to write files outside the intended temporary directory by manipulating package download URLs. This flaw bypasses basic filename sanitization and can lead to unauthorized overwrites of important system files, creating opportunities for further compromise. While it doesn't expose data or require user interaction, it poses a high integrity risk and is especially concerning in environments that rely on automated package handling or internal tooling built on setuptools.

Statement: Red Hat Product Security has rated this vulnerability "Moderate" based on the impact of the damage caused by a successful exploitation and the pre-requisites.

* Exploitation requires that the attacker have limited code execution access to a Python environment where they can trigger the vulnerable PackageIndex.download() function—this might be via a script, plugin, or automated job. Full admin rights aren't needed but a user with no access at all will be unable to exploit this vulnerability.
* The vulnerability impacts the integrity of the system within the same security boundary—it does not enable access or compromise across trust boundaries (e.g., from one container to another or from user space to kernel).
* Successful exploitation only allows the attacker to "create" new files. The vulnerability does not provide access to existing files and by an extension to any confidential information. 
* Arbitrary file writes can overwrite critical config files, executables, or scripts. This can lead to persistent code execution, system misconfiguration, or unauthorized behavior, especially in automated environments. While overwriting critical files could theoretically lead to service disruption, the vulnerability in isolation does not inherently cause denial of service. The exploit doesn't target availability directly, and in many cases, systems may continue running.

Remediation:
Red Hat Ansible Automation Platform
It is recommended that existing users of Red Hat OpenShift Builds 1.3.z upgrades to to 1.4.1
It is recommended that existing users of Red Hat OpenShift Builds 1.3.z upgrades to to 1.4.1
It is recommended that existing users of Red Hat OpenShift Builds 1.4.z upgrades to to 1.5.0
For more about Red Hat Developer Hub, see References links
For more about Red Hat Developer Hub, see References links
For more information visit https://access.redhat.com/errata/RHSA-2025:19427
For more information visit https://access.redhat.com/errata/RHSA-2025:19429
For more information visit https://access.redhat.com/errata/RHSA-2025:19424
For more information visit https://access.redhat.com/errata/RHSA-2025:19430
For more information visit https://access.redhat.com/errata/RHSA-2025:19426
For more information visit https://access.redhat.com/errata/RHSA-2025:19422
For more information visit https://access.redhat.com/errata/RHSA-2025:19428
For more information visit https://access.redhat.com/errata/RHSA-2025:19425
For more information visit https://access.redhat.com/errata/RHSA-2025:19421
For more information visit https://access.redhat.com/errata/RHSA-2025:19423
Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11458
The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the "podman pull" command. For more information about the image, search the <image_name> in the Red Hat Ecosystem Catalog: https://catalog.redhat.com/software/containers/search.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.