Possible remote code execution through package index

[jaraco]

On April 22, the Setuptools project received a report of a possible vulnerability through Tidelift. This issue tracks the repair and eventual disclosure of that vulnerability.

This issue affects deprecated portions of Setuptools and is not believed to affect the bulk of users, especially those reliant on modern packaging installers (e.g. pip).

Status:

• reported
• investigated
• acknowledged and confirmed
• CVE drafted
• remediation committed and released

Edit:

The issue is a possible remote code execution by supplying malicious URLs in a package index or via the command line. The issue boils down to unsafe use of os.system. Because easy_install and package_index are deprecated, the attack surface is smaller, but it's conceivable through social engineering or minor compromise to a package index could grant remote access. The fix was released in v70.0.0.

[jaraco]

We've been tracking this issue on huntr.com and in this doc.

[jaraco]

The issue was fixed in #4332.