A vulnerability in setuptools on Windows allows a crafted wheel's namespace_packages.txt to cause legacy wheel installation to create an __init__.py file outside the intended installation directory. The attacker can control the destination path of this file but not its contents. This occurs because an absolute Windows path in namespace_packages.txt is improperly handled, leading to path escape during installation.
A regular expression used in the OpenTelemetry Python API's TraceState.from_header method causes quadratic CPU time complexity when parsing specially crafted tracestate headers with long runs of spaces or tabs. This can lead to denial of service by blocking the handling worker for several seconds on a single unauthenticated request. The issue affects versions from 1.0.0 through at least v1.45.0 and is fixed in version 5.14.0_18.
Multiple vulnerabilities in aiohttp versions from 5.14.0_13 up to but not including 5.14.0_18 can lead to excessive or unbounded memory and CPU usage triggered by attacker-controlled requests. This resource exhaustion can disrupt service availability. A fix is available in version 5.14.0_18.
The pure Python HTTP parser in AIOHTTP is vulnerable to an HTTP request smuggling attack when used instead of the default C parser. This affects applications using the Python parser, such as those with the AIOHTTP_NO_EXTENSIONS environment or non-standard wheel installations. A fix is available in version 5.14.0_18. Users are advised to switch to the default C parser to mitigate the issue.
A vulnerability in ScoutSuite versions >=5.14.0_13 and <5.14.0_18 allows a subdomain to remove the Host-Only flag from an existing cookie set for a parent domain. This could reduce cookie security protections for users accessing untrusted subdomains. The impact is limited because most use cases do not reflect these cookies back to browsers.
AIOHTTP versions from 5.14.0_13 up to but not including 5.14.0_18 contain a vulnerability where an attacker can send an absolute-form HTTP request to spoof the Request.scheme attribute. This can mislead applications relying on this attribute for security decisions, potentially causing them to misinterpret whether a connection is encrypted. The issue is fixed in version 5.14.0_18.
AIOHTTP versions from 5.14.0_13 up to but not including 5.14.0_18 contain a vulnerability where specially crafted multipart requests can exhaust file descriptors. This occurs if a handler uses the Request.post() method, potentially leading to resource exhaustion on the affected system. The issue has been fixed in version 5.14.0_18.
A vulnerability in AIOHTTP's Max-Age processing can cause an overflow that prevents connections from closing properly. This may allow an attacker to temporarily exhaust the connection pool until garbage collection reclaims the connections. The issue affects ScoutSuite versions from 5.14.0_13 up to but not including 5.14.0_18. A fix is available in version 5.14.0_18.
Scoutsuite versions from 5.14.0_13 up to but not including 5.14.0_18 have a vulnerability where the aiohttp server does not enforce an initial request/header timeout. This allows an attacker to keep an idle connection open indefinitely before sending any data, potentially leading to resource exhaustion. A fix is available in version 5.14.0_18. The recommended mitigation is to use a reverse proxy with sensible keepalive limits, which is advised for all production deployments.
A vulnerability in scoutsuite versions >=5.14.0_13 and <5.14.0_18 allows the Secure attribute of shared cookies to not be enforced. This means a cookie marked as Secure could be sent over unencrypted requests, potentially exposing sensitive cookie data.
A Unicode normalization mismatch in setuptools causes MANIFEST.in exclusion rules to fail on macOS APFS/HFS+ filesystems. When building source distributions, files with names stored in NFD form on disk do not match exclusion patterns written in NFC form, resulting in unintended inclusion of excluded files in published source packages. This can lead to irreversible disclosure of sensitive files on the public PyPI index. The issue affects non-ASCII filenames and is specific to normalization-preserving filesystems like macOS APFS and HFS+. A fix is available in setuptools version 5.14.0_15.
A path traversal vulnerability in the setuptools PackageIndex.download function allows an attacker to write files to arbitrary filesystem locations with the permissions of the running process. This flaw arises from insufficient sanitization of URL-derived filenames used in os.path.join, enabling path traversal despite some replacement of '..' sequences. The vulnerability was fixed in setuptools version 5.14.0_2. Exploitation could lead to arbitrary file write and potentially remote code execution depending on context. The affected product is ScoutSuite versions >=5.13.0 and <5.14.0_2.
CVE-2024-6345 is a high-severity vulnerability in the package_index module of pypa/setuptools up to version 69.1.1. It allows remote code execution via command injection through download functions that handle package URLs. This flaw can be exploited if user-controlled URLs are processed, enabling arbitrary command execution on the affected system. The vulnerability is fixed in setuptools version 70.0.