CVE Feed

    Dashboard / CVE / CVE-2022-40897

    CVE-2022-40897

    Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.

    Published:Dec 22, 2022
    Last Modified:Nov 4, 2025
    EPS:Dec 22, 2022
    EPSS Score:0.00339
    CVSS Score:5.9

    Affected Products

    Vendor
    Python
    Product
    Setuptools
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Rhel Aus
    Vendor
    Redhat
    Product
    Rhel E4s
    Vendor
    Redhat
    Product
    Rhel Eus
    Vendor
    Redhat
    Product
    Rhel Software Collections
    Vendor
    Redhat
    Product
    Rhel Tus

    Exploits

    https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/

    References

    https://github.com/pypa/setuptools/blob/fe8a98e696241487ba6ac9f91faa38ade939ec5d/setuptools/package_index.py#L200
    https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be
    https://github.com/pypa/setuptools/compare/v65.5.0...v65.5.1
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ADES3NLOE5QJKBLGNZNI2RGVOSQXA37R/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YNA2BAH2ACBZ4TVJZKFLCR7L23BG5C3H/
    https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/
    https://pyup.io/vulnerabilities/CVE-2022-40897/52495/
    https://security.netapp.com/advisory/ntap-20230214-0001/
    https://security.netapp.com/advisory/ntap-20240621-0006/
    https://github.com/pypa/setuptools/blob/fe8a98e696241487ba6ac9f91faa38ade939ec5d/setuptools/package_index.py#L200
    https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be
    https://github.com/pypa/setuptools/compare/v65.5.0...v65.5.1
    https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ADES3NLOE5QJKBLGNZNI2RGVOSQXA37R/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YNA2BAH2ACBZ4TVJZKFLCR7L23BG5C3H/
    https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/
    https://pyup.io/vulnerabilities/CVE-2022-40897/52495/
    https://security.netapp.com/advisory/ntap-20230214-0001/
    https://security.netapp.com/advisory/ntap-20240621-0006/

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High