synced 13 MIN AGO
01 Record

CVE-2022-40897

Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression

MediumPUBLISHEDCNA: mitre
CNA base score5.9 CVSS v3.xCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
View raw JSON

02 Description

Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression

03 Exploitation and scoring

Exploitation
Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.
SSVC decision
  • ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
  • AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
  • Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.
CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.
EPSS probability
2.63% probability of exploitation activity in the next 30 days.
EPSS percentile
Equal to or higher than the score of 85.4% of scored records. A rank, not a probability.
NVD base score
5.9 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD analysis status
Modified. NVD last modified this record on 2026-06-17.
Red Hat severity
Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published
2022-12-22 00:00Z3 YR AGO
Last updated
2025-11-04 16:09Z11 MO AGO
Reserved
2022-09-19
Assigning CNA
mitre
Record state
PUBLISHED
Severity
Medium (CVSS 5.9)
CNA CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
  • CWE-1333Inefficient Regular Expression ComplexityBase
  • CWE-185Incorrect Regular ExpressionClass
Data version
5.2
Document digest
1c0b4b5e437254dbfb3337706f6c0b6dd2ec49e747c77d74c83ef1791b57c23b

05 Affected products

VendorProductVersionsPlatforms
pythonsetuptoolsNot specified—
redhatansible_automation_platformNot specified—
redhatenterprise_linuxNot specified—
redhatopenshiftNot specified—
redhatopenshift_devspacesNot specified—
redhatopenstackNot specified—
redhatquayNot specified—
redhatrhel_ausNot specified—
redhatrhel_e4sNot specified—
redhatrhel_eusNot specified—
redhatrhel_software_collectionsNot specified—
redhatrhel_tusNot specified—
redhatrhuiNot specified—
redhatsatelliteNot specified—
redhatstfNot specified—

06 References

07 Fixed in

AlmaLinux 8

  • babel
    Fixed in 2.5.1-10.module_el8.6.0+2781+fed64c13
  • platform-python-setuptools
    Fixed in 39.2.0-6.el8_7.1
  • python-nose-docs
    Fixed in 1.3.7-31.module_el8.6.0+2781+fed64c13
  • python-psycopg2-doc
    Fixed in 2.7.5-8.module_el8.9.0+3640+8d3927b5
  • python-sqlalchemy-doc
    Fixed in 1.3.2-2.module_el8.6.0+2781+fed64c13
  • python2
    Fixed in 2.7.18-17.module_el8.10.0+3783+2756348e.alma
  • python2-Cython
    Fixed

    A version is affected if any line below covers it.

    • Affected before 0.28.1-7.module_el8.6.0+2781+fed64c13
    • Affected before 0.28.1-7.module_el8.6.0+3162+01a09e5a
  • python2-PyMySQL
    Fixed in 0.8.0-10.module_el8.6.0+2781+fed64c13
  • python2-attrs
    Fixed in 17.4.0-10.module_el8.6.0+2781+fed64c13
  • python2-babel
    Fixed in 2.5.1-10.module_el8.6.0+2781+fed64c13
  • python2-backports
    Fixed

    A version is affected if any line below covers it.

    • Affected before 1.0-16.module_el8.6.0+2781+fed64c13
    • Affected before 1.0-16.module_el8.6.0+3162+01a09e5a
  • python2-backports-ssl_match_hostname
    Fixed in 3.5.0.1-12.module_el8.6.0+2781+fed64c13
  • python2-bson
    Fixed

    A version is affected if any line below covers it.

    • Affected before 3.7.0-1.module_el8.6.0+2781+fed64c13
    • Affected before 3.7.0-1.module_el8.6.0+3162+01a09e5a
  • python2-chardet
    Fixed in 3.0.4-10.module_el8.6.0+2781+fed64c13
  • python2-coverage
    Fixed in 4.5.1-5.module_el8.9.0+3640+8d3927b5
  • python2-debug
    Fixed in 2.7.18-17.module_el8.10.0+3783+2756348e.alma
  • python2-devel
    Fixed in 2.7.18-17.module_el8.10.0+3783+2756348e.alma
  • python2-dns
    Fixed in 1.15.0-10.module_el8.6.0+2781+fed64c13
  • python2-docs
    Fixed in 2.7.16-2.module_el8.6.0+2781+fed64c13
  • python2-docs-info
    Fixed in 2.7.16-2.module_el8.6.0+2781+fed64c13
  • python2-docutils
    Fixed in 0.14-12.module_el8.6.0+2781+fed64c13
  • python2-funcsigs
    Fixed in 1.0.2-13.module_el8.6.0+2781+fed64c13
  • python2-idna
    Fixed in 2.5-7.module_el8.6.0+2781+fed64c13
  • python2-ipaddress
    Fixed in 1.0.18-6.module_el8.6.0+2781+fed64c13
  • python2-jinja2
    Fixed in 2.10-10.module_el8.10.0+3783+2756348e
  • python2-libs
    Fixed in 2.7.18-17.module_el8.10.0+3783+2756348e.alma
  • python2-lxml
    Fixed

    A version is affected if any line below covers it.

    • Affected before 4.2.3-6.module_el8.6.0+2781+fed64c13
    • Affected before 4.2.3-6.module_el8.6.0+3162+01a09e5a
  • python2-markupsafe
    Fixed

    A version is affected if any line below covers it.

    • Affected before 0.23-19.module_el8.6.0+2781+fed64c13
    • Affected before 0.23-19.module_el8.6.0+3162+01a09e5a
  • python2-mock
    Fixed in 2.0.0-13.module_el8.6.0+2781+fed64c13
  • python2-nose
    Fixed in 1.3.7-31.module_el8.6.0+2781+fed64c13
  • python2-numpy
    Fixed

    A version is affected if any line below covers it.

    • Affected before 1:1.14.2-16.module_el8.6.0+2781+fed64c13
    • Affected before 1:1.14.2-16.module_el8.6.0+3162+01a09e5a
  • python2-numpy-doc
    Fixed in 1:1.14.2-16.module_el8.6.0+2781+fed64c13
  • python2-numpy-f2py
    Fixed

    A version is affected if any line below covers it.

    • Affected before 1:1.14.2-16.module_el8.6.0+2781+fed64c13
    • Affected before 1:1.14.2-16.module_el8.6.0+3162+01a09e5a
  • python2-pip
    Fixed in 9.0.3-19.module_el8.6.0+2781+fed64c13
  • python2-pip-wheel
    Fixed in 9.0.3-19.module_el8.6.0+2781+fed64c13
  • python2-pluggy
    Fixed in 0.6.0-8.module_el8.6.0+2781+fed64c13
  • python2-psycopg2
    Fixed in 2.7.5-8.module_el8.9.0+3640+8d3927b5
  • python2-psycopg2-debug
    Fixed in 2.7.5-8.module_el8.9.0+3640+8d3927b5
  • python2-psycopg2-tests
    Fixed in 2.7.5-8.module_el8.9.0+3640+8d3927b5
  • python2-py
    Fixed in 1.5.3-6.module_el8.6.0+2781+fed64c13

74 further packages in AlmaLinux 8 not shown (first 40 listed).

Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

AlmaLinux 9

  • python3-setuptools
    Fixed in 53.0.0-10.el9_1.1
  • python3-setuptools-wheel
    Fixed in 53.0.0-10.el9_1.1

Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

CloudLinux 8

  • babel
    Fixed in 2.5.1-10.module_el8.6.0+2781+fed64c13
  • platform-python-setuptools
    Fixed in 39.2.0-6.el8_7.1
  • python-nose-docs
    Fixed in 1.3.7-31.module_el8.6.0+2781+fed64c13
  • python-psycopg2-doc
    Fixed in 2.7.5-8.module_el8.9.0+3640+8d3927b5
  • python-sqlalchemy-doc
    Fixed in 1.3.2-2.module_el8.6.0+2781+fed64c13
  • python2
    Fixed in 2.7.18-17.module_el8.10.0+3783+2756348e.alma
  • python2-Cython
    Fixed

    A version is affected if any line below covers it.

    • Affected before 0.28.1-7.module_el8.6.0+2781+fed64c13
    • Affected before 0.28.1-7.module_el8.6.0+3162+01a09e5a
  • python2-PyMySQL
    Fixed in 0.8.0-10.module_el8.6.0+2781+fed64c13
  • python2-attrs
    Fixed in 17.4.0-10.module_el8.6.0+2781+fed64c13
  • python2-babel
    Fixed in 2.5.1-10.module_el8.6.0+2781+fed64c13
  • python2-backports
    Fixed

    A version is affected if any line below covers it.

    • Affected before 1.0-16.module_el8.6.0+2781+fed64c13
    • Affected before 1.0-16.module_el8.6.0+3162+01a09e5a
  • python2-backports-ssl_match_hostname
    Fixed in 3.5.0.1-12.module_el8.6.0+2781+fed64c13
  • python2-bson
    Fixed

    A version is affected if any line below covers it.

    • Affected before 3.7.0-1.module_el8.6.0+2781+fed64c13
    • Affected before 3.7.0-1.module_el8.6.0+3162+01a09e5a
  • python2-chardet
    Fixed in 3.0.4-10.module_el8.6.0+2781+fed64c13
  • python2-coverage
    Fixed in 4.5.1-5.module_el8.9.0+3640+8d3927b5
  • python2-debug
    Fixed in 2.7.18-17.module_el8.10.0+3783+2756348e.alma
  • python2-devel
    Fixed in 2.7.18-17.module_el8.10.0+3783+2756348e.alma
  • python2-dns
    Fixed in 1.15.0-10.module_el8.6.0+2781+fed64c13
  • python2-docs
    Fixed in 2.7.16-2.module_el8.6.0+2781+fed64c13
  • python2-docs-info
    Fixed in 2.7.16-2.module_el8.6.0+2781+fed64c13
  • python2-docutils
    Fixed in 0.14-12.module_el8.6.0+2781+fed64c13
  • python2-funcsigs
    Fixed in 1.0.2-13.module_el8.6.0+2781+fed64c13
  • python2-idna
    Fixed in 2.5-7.module_el8.6.0+2781+fed64c13
  • python2-ipaddress
    Fixed in 1.0.18-6.module_el8.6.0+2781+fed64c13
  • python2-jinja2
    Fixed in 2.10-10.module_el8.10.0+3783+2756348e
  • python2-libs
    Fixed in 2.7.18-17.module_el8.10.0+3783+2756348e.alma
  • python2-lxml
    Fixed

    A version is affected if any line below covers it.

    • Affected before 4.2.3-6.module_el8.6.0+2781+fed64c13
    • Affected before 4.2.3-6.module_el8.6.0+3162+01a09e5a
  • python2-markupsafe
    Fixed

    A version is affected if any line below covers it.

    • Affected before 0.23-19.module_el8.6.0+2781+fed64c13
    • Affected before 0.23-19.module_el8.6.0+3162+01a09e5a
  • python2-mock
    Fixed in 2.0.0-13.module_el8.6.0+2781+fed64c13
  • python2-nose
    Fixed in 1.3.7-31.module_el8.6.0+2781+fed64c13
  • python2-numpy
    Fixed

    A version is affected if any line below covers it.

    • Affected before 1:1.14.2-16.module_el8.6.0+2781+fed64c13
    • Affected before 1:1.14.2-16.module_el8.6.0+3162+01a09e5a
  • python2-numpy-doc
    Fixed in 1:1.14.2-16.module_el8.6.0+2781+fed64c13
  • python2-numpy-f2py
    Fixed

    A version is affected if any line below covers it.

    • Affected before 1:1.14.2-16.module_el8.6.0+2781+fed64c13
    • Affected before 1:1.14.2-16.module_el8.6.0+3162+01a09e5a
  • python2-pip
    Fixed in 9.0.3-19.module_el8.6.0+2781+fed64c13
  • python2-pip-wheel
    Fixed in 9.0.3-19.module_el8.6.0+2781+fed64c13
  • python2-pluggy
    Fixed in 0.6.0-8.module_el8.6.0+2781+fed64c13
  • python2-psycopg2
    Fixed in 2.7.5-8.module_el8.9.0+3640+8d3927b5
  • python2-psycopg2-debug
    Fixed in 2.7.5-8.module_el8.9.0+3640+8d3927b5
  • python2-psycopg2-tests
    Fixed in 2.7.5-8.module_el8.9.0+3640+8d3927b5
  • python2-py
    Fixed in 1.5.3-6.module_el8.6.0+2781+fed64c13

74 further packages in CloudLinux 8 not shown (first 40 listed).

Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.

Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

CloudLinux 9

  • python3-setuptools
    Fixed in 53.0.0-10.el9_1.1
  • python3-setuptools-wheel
    Fixed in 53.0.0-10.el9_1.1

Derived from AlmaLinux 9. Partial coverage: only packages taken from AlmaLinux 9 are listed.

Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

Debian 12

  • setuptools
    Fixed in 65.6.3-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

  • setuptools
    Fixed in 65.6.3-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

  • setuptools
    Fixed in 65.6.3-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 18.04 LTS

  • python-pip
    Fixed in 9.0.1-2.3~ubuntu1.18.04.6
  • python-setuptools
    Fixed in 39.0.1-2ubuntu0.1

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 20.04 LTS

  • python-pip
    Fixed in 20.0.2-5ubuntu1.7
  • python-setuptools
    Fixed in 44.0.0-2ubuntu0.1
  • setuptools
    Fixed in 45.2.0-1ubuntu0.1

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 22.04 LTS

  • python-pip
    Fixed in 22.0.2+dfsg-1ubuntu0.1
  • python-setuptools
    Fixed in 44.1.1-1.2ubuntu0.22.04.1
  • setuptools
    Fixed in 59.6.0-1.2ubuntu0.22.04.1

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu Pro 14.04 LTS

  • python-pip
    Fixed in 1.5.4-1ubuntu4+esm2
    Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro
  • python-setuptools
    Fixed in 3.3-1ubuntu2+esm1
    Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu Pro 16.04 LTS

  • python-pip
    Fixed in 8.1.1-2ubuntu0.6+esm3
    Available with Ubuntu Pro: https://ubuntu.com/pro
  • python-setuptools
    Fixed in 20.7.0-1ubuntu0.1~esm1
    Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.