Threats affecting pkg:brew/pip-tools

A vulnerability in setuptools on Windows allows an attacker to craft a wheel containing a .dist-info/namespace_packages.txt file with an absolute Windows path. During legacy wheel installation, this causes setuptools to create an __init__.py file outside the intended installation directory at a path influenced by the attacker. The created file has fixed content and is created with the permissions of the installing process. The vulnerability requires the target parent directory to already exist.

A Unicode normalization mismatch in setuptools' handling of MANIFEST.in exclusion rules can cause files intended to be excluded from source distributions to be included instead on macOS APFS/HFS+ filesystems. This occurs because the matching process compares byte sequences without Unicode normalization, causing NFC-encoded patterns to fail to match NFD-encoded filenames. As a result, sensitive files with non-ASCII names may be unintentionally published to PyPI. This issue affects setuptools versions prior to 7.5.3_1 and has been fixed in 7.5.3_1.

A path traversal vulnerability in the setuptools PackageIndex.download function allows an attacker to write files to arbitrary filesystem locations with the permissions of the running process. This flaw arises from insufficient sanitization of URL-derived filenames used in os.path.join, enabling path traversal despite some replacement of '..' sequences. The vulnerability affects pip-tools versions >=7.3.0_1 and <7.4.1_2 and was fixed in version 7.4.1_2. Exploitation could lead to arbitrary file write and potentially remote code execution depending on context. The vulnerability has a high severity score (CVSS 8.7) and no known exploits in the wild have been reported. The risk is somewhat reduced due to deprecation of easy_install and package_index components.

CVE-2024-6345 is a high-severity vulnerability in the package_index module of pypa/setuptools used by pip-tools. Versions up to 69.1.1 allow remote code execution via download functions that process package URLs. These functions can be exploited if they handle user-controlled inputs, enabling arbitrary command execution. The issue is fixed in setuptools version 70.0 and pip-tools version 7.4.1_1.