CVE-2022-40897
Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
- Published Dec 23, 2022
- CVSS 5.9 medium
- 2.5% chance of exploitation in the next 30 days (EPSS)
- Public exploit code is available
- A fix is available