NS-SA-2025-0086

简介

important: python-setuptools/shim security update

严重级别

important

主题

An update for python-setuptools/shim is now available for NewStart CGSL MAIN 7.02.
NewStart Security has rated this update as having a security impact of important. A Common Vunlnerability Scoring System(CVSS)base score, which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.

详细描述

python-setuptools:
shim:


Security Fix(es):
python-setuptools: A flaw was found in the package_index module of pypa/setuptools. Affected versions of this package allow remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.(CVE-2024-6345)
python-setuptools: bugfix
shim: A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.(CVE-2023-40546)
shim: An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.(CVE-2023-40549)
shim: An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.(CVE-2023-40550)
shim: A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.(CVE-2023-40551)
shim: bugfix


Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
http://security.gd-linux.com/how_to_apply_patch.html
Remember the build tag is 7.02.02B7.

影响组件

• python-setuptools
• shim

影响产品

• CGSL MAIN 7.02

更新包

CVE

• CVE-2024-6345
• CVE-2023-40546
• CVE-2023-40549
• CVE-2023-40550
• CVE-2023-40551

参考

• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-6345
• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-40546
• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-40549
• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-40550
• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-40551