Wind River Support Network

HomeDefectsLIN1025-1306

Fixed

LIN1025-1306 : Security Advisory - python-setuptools - CVE-2025-47273

Created: May 18, 2025 Updated: Sep 21, 2025

Resolved Date: Aug 13, 2025

Found In Version: 10.25.33.1

Fix Version: 10.25.33.1

Severity: Standard

Applicable for: Wind River Linux LTS 25

Component/s: Userspace

Description

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue.

CREATE(Triage):(User=admin) CVE-2025-47273 (https://nvd.nist.gov/vuln/detail/CVE-2025-47273)