Threats affecting pkg:brew/ccm

A vulnerability in setuptools on Windows allows a crafted wheel's namespace_packages.txt to cause legacy wheel installation to create an __init__.py file outside the intended installation directory. The created file has fixed content and is placed at a filesystem path influenced by the wheel, with the permissions of the installing process. The parent directory must already exist for this to occur.

A Unicode normalization mismatch in setuptools' handling of MANIFEST.in exclusions can cause files intended to be excluded from source distributions to be included instead. This occurs because on macOS APFS/HFS+ filesystems, filenames are stored in NFD form, but MANIFEST.in patterns are typically written in NFC form, leading to a byte-level mismatch during exclusion matching. As a result, sensitive files with non-ASCII names may be unintentionally published to PyPI. The issue affects setuptools versions prior to 3.1.5_6 and has been fixed in 3.1.5_6.

A path traversal vulnerability in the PackageIndex.download function of setuptools allows an attacker to write files to arbitrary filesystem locations. This occurs because the filename derived from a URL is insufficiently sanitized, enabling path traversal despite some replacement of '..'. The vulnerability was fixed in setuptools version 3.1.5_5. Exploitation could lead to arbitrary file write with the permissions of the running process, potentially escalating to remote code execution depending on context.

A command injection vulnerability exists in the package_index module of pypa/setuptools versions up to 69.1.1, allowing remote code execution via malicious package URLs. This flaw is fixed in version 70.0. The affected product 'ccm' versions >=3.1.5_3 and <3.1.5_4 are vulnerable. The vulnerability has a high severity CVSS score of 8.8.