CVE-2022-40897: python setuptools

Modified

AliasesMGASA-2023-0219SUSE-SU-2023:0091-1SUSE-SU-2023:0093-1+22 more

Published 22-12-2022Last modified 04-11-2025

Vulnerability summary

CVE-2022-40897 is a medium (CVSS 5.9) vulnerability in python setuptools. EPSS estimates a 2.63% chance of exploitation in the next 30 days, higher than 85.5% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Routine

Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.9/10

010

Medium · v3.1 (CVE.org)

EPSS score

2.63%

0%100%

Low · +0.13 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 5 · Related 2

DLA-3876-1 RHSA-2023:6793 RHSA-2024:2985 RHSA-2024:2987 RHSA-2024:6915 CGA-46GG-582C-CWR8+1 more

Timeline

22-12-2022
PublishedVulnerability first disclosed.
04-11-2025
Last modifiedVulnerability information updated.

Description

Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.

CVSS metrics

8 scores · 7 sources · 2 versions

v4.08.7v3.15.9

EPSS trend

Probability

2.63%

Chance of exploitation in the next 30 days

Percentile

86%

Versus all other CVEs

30-day change

Increase +0.13 pp

From 2.50% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (pyup.io)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-1333Inefficient Regular Expression ComplexityThe product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat106 products

Cython< 0:0.29.21-5.module+el8.4.0+9822+20bf1249
Cython-debugsource< 0:0.29.21-5.module+el8.4.0+9822+20bf1249
mod_wsgi< 0:4.7.1-5.module+el8.7.0+16654+645aad7f
numpy< 0:1.19.4-3.module+el8.5.0+12204+54860423
numpy-debugsource< 0:1.19.4-3.module+el8.5.0+12204+54860423

platform-python-setuptools< 0:39.2.0-6.el8_7.1 | < 0:39.2.0-7.el8_6
pybind11< 0:2.7.1-1.module+el8.6.0+12838+640e6226
pytest< 0:6.0.2-2.module+el8.4.0+9822+20bf1249
python-attrs< 0:20.3.0-2.module+el8.4.0+9822+20bf1249
python-cffi< 0:1.14.3-2.module+el8.4.0+9822+20bf1249
python-cffi-debugsource< 0:1.14.3-2.module+el8.4.0+9822+20bf1249
python-chardet< 0:3.0.4-19.module+el8.4.0+9822+20bf1249
python-cryptography< 0:3.3.1-2.module+el8.4.0+9822+20bf1249
python-cryptography-debugsource< 0:3.3.1-2.module+el8.4.0+9822+20bf1249
python-idna< 0:2.10-3.module+el8.4.0+9822+20bf1249
python-iniconfig< 0:1.1.1-2.module+el8.4.0+9822+20bf1249
python-lxml< 0:4.6.5-1.module+el8.6.0+13933+9cf0c87c
python-lxml-debugsource< 0:4.6.5-1.module+el8.6.0+13933+9cf0c87c
python-more-itertools< 0:8.5.0-2.module+el8.4.0+9822+20bf1249
python-packaging< 0:20.4-4.module+el8.4.0+9822+20bf1249
python-pluggy< 0:0.13.1-3.module+el8.4.0+9822+20bf1249
python-ply< 0:3.11-10.module+el8.4.0+9822+20bf1249
python-psutil< 0:5.8.0-4.module+el8.4.0+9822+20bf1249
python-psutil-debugsource< 0:5.8.0-4.module+el8.4.0+9822+20bf1249
python-psycopg2< 0:2.8.6-2.module+el8.4.0+9822+20bf1249
python-psycopg2-debugsource< 0:2.8.6-2.module+el8.4.0+9822+20bf1249
python-py< 0:1.10.0-1.module+el8.4.0+9822+20bf1249
python-pycparser< 0:2.20-3.module+el8.4.0+9822+20bf1249
python-PyMySQL< 0:0.10.1-2.module+el8.4.0+9822+20bf1249
python-pysocks< 0:1.7.1-4.module+el8.4.0+9822+20bf1249
python-requests< 0:2.25.0-2.module+el8.4.0+9822+20bf1249
python-setuptools< 0:39.2.0-6.el8_7.1 | < 0:53.0.0-10.el9_1.1 | < 0:39.2.0-7.el8_6
python-toml< 0:0.10.1-5.module+el8.4.0+9822+20bf1249
python-urllib3< 0:1.25.10-4.module+el8.5.0+11712+ea2d2be1
python-wcwidth< 0:0.2.5-3.module+el8.4.0+9822+20bf1249
python-wheel< 1:0.35.1-4.module+el8.5.0+12204+54860423
python3-setuptools< 0:39.2.0-6.el8_7.1 | < 0:53.0.0-10.el9_1.1 | < 0:39.2.0-7.el8_6
python3-setuptools-wheel< 0:39.2.0-6.el8_7.1 | < 0:53.0.0-10.el9_1.1 | < 0:39.2.0-7.el8_6
python39< 0:3.9.16-1.module+el8.8.0+20025+f2100191.2
python39-attrs< 0:20.3.0-2.module+el8.4.0+9822+20bf1249
python39-cffi< 0:1.14.3-2.module+el8.4.0+9822+20bf1249
python39-cffi-debuginfo< 0:1.14.3-2.module+el8.4.0+9822+20bf1249
python39-chardet< 0:3.0.4-19.module+el8.4.0+9822+20bf1249
python39-cryptography< 0:3.3.1-2.module+el8.4.0+9822+20bf1249
python39-cryptography-debuginfo< 0:3.3.1-2.module+el8.4.0+9822+20bf1249
python39-Cython< 0:0.29.21-5.module+el8.4.0+9822+20bf1249
python39-Cython-debuginfo< 0:0.29.21-5.module+el8.4.0+9822+20bf1249
python39-debug< 0:3.9.16-1.module+el8.8.0+20025+f2100191.2
python39-debuginfo< 0:3.9.16-1.module+el8.8.0+20025+f2100191.2
python39-debugsource< 0:3.9.16-1.module+el8.8.0+20025+f2100191.2
python39-devel< 0:3.9.16-1.module+el8.8.0+20025+f2100191.2
python39-idle< 0:3.9.16-1.module+el8.8.0+20025+f2100191.2
python39-idna< 0:2.10-3.module+el8.4.0+9822+20bf1249
python39-iniconfig< 0:1.1.1-2.module+el8.4.0+9822+20bf1249
python39-libs< 0:3.9.16-1.module+el8.8.0+20025+f2100191.2
python39-lxml< 0:4.6.5-1.module+el8.6.0+13933+9cf0c87c
python39-lxml-debuginfo< 0:4.6.5-1.module+el8.6.0+13933+9cf0c87c
python39-mod_wsgi< 0:4.7.1-5.module+el8.7.0+16654+645aad7f
python39-more-itertools< 0:8.5.0-2.module+el8.4.0+9822+20bf1249
python39-numpy< 0:1.19.4-3.module+el8.5.0+12204+54860423
python39-numpy-debuginfo< 0:1.19.4-3.module+el8.5.0+12204+54860423
python39-numpy-doc< 0:1.19.4-3.module+el8.5.0+12204+54860423
python39-numpy-f2py< 0:1.19.4-3.module+el8.5.0+12204+54860423
python39-packaging< 0:20.4-4.module+el8.4.0+9822+20bf1249
python39-pip< 0:20.2.4-7.module+el8.6.0+13003+6bb2c488
python39-pip-wheel< 0:20.2.4-7.module+el8.6.0+13003+6bb2c488
python39-pluggy< 0:0.13.1-3.module+el8.4.0+9822+20bf1249
python39-ply< 0:3.11-10.module+el8.4.0+9822+20bf1249
python39-psutil< 0:5.8.0-4.module+el8.4.0+9822+20bf1249
python39-psutil-debuginfo< 0:5.8.0-4.module+el8.4.0+9822+20bf1249
python39-psycopg2< 0:2.8.6-2.module+el8.4.0+9822+20bf1249
python39-psycopg2-debuginfo< 0:2.8.6-2.module+el8.4.0+9822+20bf1249
python39-psycopg2-doc< 0:2.8.6-2.module+el8.4.0+9822+20bf1249
python39-psycopg2-tests< 0:2.8.6-2.module+el8.4.0+9822+20bf1249
python39-py< 0:1.10.0-1.module+el8.4.0+9822+20bf1249
python39-pybind11< 0:2.7.1-1.module+el8.6.0+12838+640e6226
python39-pybind11-devel< 0:2.7.1-1.module+el8.6.0+12838+640e6226
python39-pycparser< 0:2.20-3.module+el8.4.0+9822+20bf1249
python39-PyMySQL< 0:0.10.1-2.module+el8.4.0+9822+20bf1249
python39-pyparsing< 0:2.4.7-5.module+el8.4.0+9822+20bf1249
python39-pysocks< 0:1.7.1-4.module+el8.4.0+9822+20bf1249
python39-pytest< 0:6.0.2-2.module+el8.4.0+9822+20bf1249
python39-pyyaml< 0:5.4.1-1.module+el8.5.0+10613+59a13ec4
python39-pyyaml-debuginfo< 0:5.4.1-1.module+el8.5.0+10613+59a13ec4
python39-requests< 0:2.25.0-2.module+el8.4.0+9822+20bf1249
python39-rpm-macros< 0:3.9.16-1.module+el8.8.0+20025+f2100191.2
python39-scipy< 0:1.5.4-3.module+el8.4.0+9822+20bf1249
python39-scipy-debuginfo< 0:1.5.4-3.module+el8.4.0+9822+20bf1249
python39-setuptools< 0:50.3.2-5.module+el8.8.0+21635+a173a6fa
python39-setuptools-wheel< 0:50.3.2-5.module+el8.8.0+21635+a173a6fa
python39-six< 0:1.15.0-3.module+el8.4.0+9822+20bf1249
python39-test< 0:3.9.16-1.module+el8.8.0+20025+f2100191.2
python39-tkinter< 0:3.9.16-1.module+el8.8.0+20025+f2100191.2
python39-toml< 0:0.10.1-5.module+el8.4.0+9822+20bf1249
python39-urllib3< 0:1.25.10-4.module+el8.5.0+11712+ea2d2be1
python39-wcwidth< 0:0.2.5-3.module+el8.4.0+9822+20bf1249
python39-wheel< 1:0.35.1-4.module+el8.5.0+12204+54860423
python39-wheel-wheel< 1:0.35.1-4.module+el8.5.0+12204+54860423
python3x-pip< 0:20.2.4-7.module+el8.6.0+13003+6bb2c488
python3x-pyparsing< 0:2.4.7-5.module+el8.4.0+9822+20bf1249
python3x-setuptools< 0:50.3.2-5.module+el8.8.0+21635+a173a6fa
python3x-six< 0:1.15.0-3.module+el8.4.0+9822+20bf1249
PyYAML< 0:5.4.1-1.module+el8.5.0+10613+59a13ec4
PyYAML-debugsource< 0:5.4.1-1.module+el8.5.0+10613+59a13ec4
scipy< 0:1.5.4-3.module+el8.4.0+9822+20bf1249
scipy-debugsource< 0:1.5.4-3.module+el8.4.0+9822+20bf1249

Show all 106

Suse32 products

python-setuptools-test&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4< 44.1.1-150400.3.3.1
python-setuptools-test&distro=SUSE Linux Enterprise Real Time 15 SP3< 40.5.0-150100.6.6.1
python-setuptools-wheel&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4< 44.1.1-150400.3.3.1
python-setuptools-wheel&distro=SUSE Linux Enterprise Real Time 15 SP3< 40.5.0-150100.6.6.1
python-setuptools&distro=HPE Helion OpenStack 8< 36.5.0-3.3.1

python-setuptools&distro=SUSE Linux Enterprise Micro 5.1< 40.5.0-150100.6.6.1
python-setuptools&distro=SUSE Linux Enterprise Micro 5.2< 40.5.0-150100.6.6.1
python-setuptools&distro=SUSE Linux Enterprise Micro 5.3< 44.1.1-150400.3.3.1
python-setuptools&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4< 44.1.1-150400.3.3.1
python-setuptools&distro=SUSE Linux Enterprise Module for Containers 12< 40.6.2-4.21.1
python-setuptools&distro=SUSE Linux Enterprise Module for Public Cloud 12< 40.6.2-4.21.1
python-setuptools&distro=SUSE Linux Enterprise Real Time 15 SP3< 40.5.0-150100.6.6.1
python-setuptools&distro=SUSE Linux Enterprise Server 12 SP5< 40.6.2-4.21.1
python-setuptools&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 40.6.2-4.21.1
python-setuptools&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 40.6.2-4.21.1
python-setuptools&distro=SUSE OpenStack Cloud 8< 36.5.0-3.3.1
python-setuptools&distro=SUSE OpenStack Cloud 9< 40.1.0-3.3.1
python-setuptools&distro=SUSE OpenStack Cloud Crowbar 8< 36.5.0-3.3.1
python-setuptools&distro=SUSE OpenStack Cloud Crowbar 9< 40.1.0-3.3.1
python3-setuptools-test&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4< 44.1.1-150400.9.6.1
python3-setuptools-test&distro=SUSE Linux Enterprise Module for Basesystem 15 SP5< 44.1.1-150400.9.6.1
python3-setuptools-wheel&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4< 44.1.1-150400.9.6.1
python3-setuptools-wheel&distro=SUSE Linux Enterprise Module for Basesystem 15 SP5< 44.1.1-150400.9.6.1
python3-setuptools&distro=SUSE Linux Enterprise Micro 5.3< 44.1.1-150400.9.6.1
python3-setuptools&distro=SUSE Linux Enterprise Micro 5.4< 44.1.1-150400.9.6.1
python3-setuptools&distro=SUSE Linux Enterprise Micro 5.5< 44.1.1-150400.9.6.1
python3-setuptools&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4< 44.1.1-150400.9.6.1
python3-setuptools&distro=SUSE Linux Enterprise Module for Basesystem 15 SP5< 44.1.1-150400.9.6.1
python310-setuptools&distro=SUSE Linux Enterprise Module for Python 3 15 SP4< 57.4.0-150400.4.3.1
python36-setuptools&distro=SUSE Linux Enterprise Server 12 SP5< 44.1.1-8.6.1
python36-setuptools&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 44.1.1-8.6.1
python39-setuptools&distro=SUSE Linux Enterprise Real Time 15 SP3< 44.1.1-150300.7.6.1

Show all 32

Opensuse15 products

python-setuptools-test&distro=openSUSE Leap 15.4< 44.1.1-150400.3.3.1
python-setuptools-wheel&distro=openSUSE Leap 15.4< 44.1.1-150400.3.3.1
python-setuptools&distro=openSUSE Leap 15.4< 44.1.1-150400.3.3.1
python-setuptools&distro=openSUSE Leap Micro 5.2< 40.5.0-150100.6.6.1
python-setuptools&distro=openSUSE Leap Micro 5.3< 44.1.1-150400.3.3.1

Show all 15

Ubuntu3 products

python-pip< 1.5.4-1ubuntu4+esm2 | < 8.1.1-2ubuntu0.6+esm3 | < 9.0.1-2.3~ubuntu1.18.04.6 | < 20.0.2-5ubuntu1.7 | < 22.0.2+dfsg-1ubuntu0.1
python-setuptools< 3.3-1ubuntu2+esm1 | < 20.7.0-1ubuntu0.1~esm1 | < 39.0.1-2ubuntu0.1 | < 44.0.0-2ubuntu0.1 | < 44.1.1-1.2ubuntu0.22.04.1
setuptools< 45.2.0-1ubuntu0.1 | < 59.6.0-1.2ubuntu0.22.04.1

Chainguard2 products

graalvm-24-graalpyAll versions (No fix recorded)
graalvm-24-graalpy-venvAll versions (No fix recorded)

Debian1 product

setuptools< 65.6.3-1

Mageia1 product

python-setuptools< 56.2.0-1.1.mga8

PyPI1 product

setuptools< 43a9c9bfa6aa626ec2a22540bea28d2ca77964be | < 65.5.1

Python1 product

setuptools< 65.5.1

9 vendors · 162 products

References

56 links

github.com/pypa/setuptools/blob/fe8a98e696241487ba6ac9f91faa38ade939ec5d/setuptools/package_index.pyWEBREPORTThird Party Advisory
pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/WEBREPORTExploitPatchTechnical DescriptionVendor Advisory
github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964beWEBFIXREPORTPatchThird Party Advisory
pyup.io/vulnerabilities/CVE-2022-40897/52495/WEBARTICLEThird Party Advisory
github.com/pypa/setuptools/compare/v65.5.0...v65.5.1WEBRelease NotesThird Party Advisory
security.netapp.com/advisory/ntap-20230214-0001/Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryAdvisory
lists.fedoraproject.org/archives/…Vendor AdvisoryAdvisory
security.netapp.com/advisory/ntap-20240621-0006/Advisory
lists.debian.org/debian-lts-announce/2024/09/msg00018.htmlWEB

Show all 56 references