[CVE-2025-47273, CVE-2024-6345] in setuptools 67.6.1 bundled with Python 3.12 Runtime

Bug report

Bug description:

Python 3.12 runtime includes a vulnerable version of setuptools (v67.6.1).
File location: /lib/python3.12/test/wheeldata/setuptools-67.6.1-py3-none-any.whl

It is present in the final runtime layer, causing vulnerability scanners to flag the image with high-severity CVEs.

While this file is not actively used by a running application, its presence on the filesystem is sufficient for security scanners to detect and report these vulnerabilities.

for other versions also, we're seeing multiple setuptools versions installed along with the latest v80.9.0

3.9.23: v58.1.0
3.10.18, 3.11.13: v65.5.0
3.12.11, 3.13.4: v67.6.1

We wanted to know if this multiple setuptools installation behaviour is fixed in upcoming Python version upgrades.

CPython versions tested on:

3.12

Operating systems tested on:

Linux

Linked PRs

[3.11] pythongh-135374: Update the bundled copy of setuptools to 79.0.1

[3.9] pythongh-135374: Update the bundled copy of setuptools to 79.0.1

[3.10] pythongh-135374: Update the bundled copy of setuptools to 79.0.1

We're seeing multiple setuptools versions installed along with the latest v80.9.0.

On Python 3.12+ setuptools is no longer installed by default so there won't be "two versions" unless the user installs setuptools on their own. Also, importantly, the old version of setuptools is inside Lib/test/wheeldata/ and is there for internal test use, it is never installed for the user. It is safe to be removed from your runtime layer.

You're right that on older supported versions of Python (3.9, 3.10, and 3.11) setuptools is bundled as part of ensurepip. I upgraded those versions to 79.0.1.

While at it, to make it less of an issue for eager security scanners in the future, I upgraded the test/wheeldata setuptools file as well since it should be a harmless operation. There is a number of breaking changes between the previous version and v79.0.1, but they shouldn't affect our limited use case inside the tests. But since there's been a lot of reported compatibility breakage with setuptools 80.x, I opted to stay at 79.0.1.

gh-135391 upgrades test/wheeldata setuptools to 79.0.1 on 3.13.
gh-135393 upgrades test/wheeldata setuptools to 79.0.1 on 3.12.
gh-135396 upgrades ensurepip setuptools to 79.0.1 on 3.11.
gh-135398 upgrades ensurepip setuptools to 79.0.1 on 3.10.
gh-135397 upgrades ensurepip setuptools to 79.0.1 on 3.9.

Note that we don't have an immediate schedule for releasing new Python versions with the upgraded versions.

[3.11] gh-135374: Update the bundled copy of setuptools to 79.0.1 (#1…

[3.10] gh-135374: Update the bundled copy of setuptools to 79.0.1 (#1…

[3.9] gh-135374: Update the bundled copy of setuptools to 79.0.1 (#13…

Strictly speaking, the vendored autocommand package isn't even ever used — so if setuptools upstream is uncooperative, a possible solution would be to reroll our own wheel with the package removed.

pythongh-135374: Adjust test for setuptools' replacement of distutils

[3.11] gh-135374: Adjust test for setuptools' replacement of distutils (

[3.11] pythongh-135374: Adjust test for setuptools' replacement of di…

[3.10] gh-135374: Adjust test for setuptools' replacement of distutils (

Hi Team, We're awaiting the CVE fix from Python Community's end.

Is there any planned release date for 3.10 and 3.11 patch versions?

@pablogsal

Is there any planned release date for 3.10 and 3.11 patch versions?

cc @pablogsal @ambv

[3.9] gh-135374: Adjust test for setuptools' replacement of distutils (…

3.9-3.12 were all released today:

https://discuss.python.org/t/python-3-12-12-3-11-14-3-10-19-and-3-9-24-are-now-available/104273

And 3.13 and 3.14 on Tuesday:

This update seems to break installing smart_open==2.1.0 on 3.11. I am pretty sure that this is all way out of compatibility policies (not a python person, but it's pretty old! :D).

Reproduction, using docker images to point to exact versions:

Working on 3.11.13:

$ docker run --rm -it --entrypoint sh docker.io/library/python:3.11@sha256:9153baea63f0b65f8cc4f5b2d064162326e25892a8a89bc543e0475c90471211 -c 'python --version;pip install --no-cache-dir --target . smart_open==2.1.0' 
Python 3.11.13
Collecting smart_open==2.1.0
  Downloading smart_open-2.1.0.tar.gz (116 kB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 116.9/116.9 kB 7.6 MB/s eta 0:00:00
  Preparing metadata (setup.py) ... done
Collecting requests (from smart_open==2.1.0)
  Downloading requests-2.32.5-py3-none-any.whl.metadata (4.9 kB)
Collecting boto (from smart_open==2.1.0)
  Downloading boto-2.49.0-py2.py3-none-any.whl.metadata (7.3 kB)
Collecting boto3 (from smart_open==2.1.0)
  Downloading boto3-1.41.5-py3-none-any.whl.metadata (6.8 kB)
Collecting botocore<1.42.0,>=1.41.5 (from boto3->smart_open==2.1.0)
  Downloading botocore-1.41.5-py3-none-any.whl.metadata (5.9 kB)
Collecting jmespath<2.0.0,>=0.7.1 (from boto3->smart_open==2.1.0)
  Downloading jmespath-1.0.1-py3-none-any.whl.metadata (7.6 kB)
Collecting s3transfer<0.16.0,>=0.15.0 (from boto3->smart_open==2.1.0)
  Downloading s3transfer-0.15.0-py3-none-any.whl.metadata (1.7 kB)
Collecting charset_normalizer<4,>=2 (from requests->smart_open==2.1.0)
  Downloading charset_normalizer-3.4.4-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl.metadata (37 kB)
Collecting idna<4,>=2.5 (from requests->smart_open==2.1.0)
  Downloading idna-3.11-py3-none-any.whl.metadata (8.4 kB)
Collecting urllib3<3,>=1.21.1 (from requests->smart_open==2.1.0)
  Downloading urllib3-2.5.0-py3-none-any.whl.metadata (6.5 kB)
Collecting certifi>=2017.4.17 (from requests->smart_open==2.1.0)
  Downloading certifi-2025.11.12-py3-none-any.whl.metadata (2.5 kB)
Collecting python-dateutil<3.0.0,>=2.1 (from botocore<1.42.0,>=1.41.5->boto3->smart_open==2.1.0)
  Downloading python_dateutil-2.9.0.post0-py2.py3-none-any.whl.metadata (8.4 kB)
Collecting six>=1.5 (from python-dateutil<3.0.0,>=2.1->botocore<1.42.0,>=1.41.5->boto3->smart_open==2.1.0)
  Downloading six-1.17.0-py2.py3-none-any.whl.metadata (1.7 kB)
Downloading boto-2.49.0-py2.py3-none-any.whl (1.4 MB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 1.4/1.4 MB 20.4 MB/s eta 0:00:00
Downloading boto3-1.41.5-py3-none-any.whl (139 kB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 139.3/139.3 kB 310.6 MB/s eta 0:00:00
Downloading requests-2.32.5-py3-none-any.whl (64 kB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 64.7/64.7 kB 190.4 MB/s eta 0:00:00
Downloading botocore-1.41.5-py3-none-any.whl (14.3 MB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 14.3/14.3 MB 44.3 MB/s eta 0:00:00
Downloading certifi-2025.11.12-py3-none-any.whl (159 kB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 159.4/159.4 kB 355.2 MB/s eta 0:00:00
Downloading charset_normalizer-3.4.4-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl (151 kB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 151.6/151.6 kB 518.0 MB/s eta 0:00:00
Downloading idna-3.11-py3-none-any.whl (71 kB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 71.0/71.0 kB 443.5 MB/s eta 0:00:00
Downloading jmespath-1.0.1-py3-none-any.whl (20 kB)
Downloading s3transfer-0.15.0-py3-none-any.whl (85 kB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 86.0/86.0 kB 300.1 MB/s eta 0:00:00
Downloading urllib3-2.5.0-py3-none-any.whl (129 kB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 129.8/129.8 kB 292.6 MB/s eta 0:00:00
Downloading python_dateutil-2.9.0.post0-py2.py3-none-any.whl (229 kB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 229.9/229.9 kB 123.1 MB/s eta 0:00:00
Downloading six-1.17.0-py2.py3-none-any.whl (11 kB)
Building wheels for collected packages: smart_open
  Building wheel for smart_open (setup.py) ... done
  Created wheel for smart_open: filename=smart_open-2.1.0-py3-none-any.whl size=110323 sha256=fa248928461663d53ca4e3801ff8ce1c00c82d2c1efd099357b5f46c2318874b
  Stored in directory: /tmp/pip-ephem-wheel-cache-juzkklb4/wheels/14/1a/9b/d9d970a520c5b1a52dc4a4e7f0cd423c623259813f723b9b22
Successfully built smart_open
Installing collected packages: boto, urllib3, six, jmespath, idna, charset_normalizer, certifi, requests, python-dateutil, botocore, s3transfer, boto3, smart_open
Successfully installed boto-2.49.0 boto3-1.41.5 botocore-1.41.5 certifi-2025.11.12 charset_normalizer-3.4.4 idna-3.11 jmespath-1.0.1 python-dateutil-2.9.0.post0 requests-2.32.5 s3transfer-0.15.0 six-1.17.0 smart_open-2.1.0 urllib3-2.5.0
WARNING: Target directory /bin already exists. Specify --upgrade to force replacement.
WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv

[notice] A new release of pip is available: 24.0 -> 25.3
[notice] To update, run: pip install --upgrade pip

Failing with 3.11.14:

$ docker run --rm -it --entrypoint sh docker.io/library/python:3.11@sha256:bf2d36b8fb1b4a0b590b36736cdd8a6b5175b411bf135c42694ecd68ab8fed02 -c 'python --version;pip install --no-cache-dir --target . smart_open==2.1.0' 
Python 3.11.14
Collecting smart_open==2.1.0
  Downloading smart_open-2.1.0.tar.gz (116 kB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 116.9/116.9 kB 6.4 MB/s eta 0:00:00
  Preparing metadata (setup.py) ... error
  error: subprocess-exited-with-error
  
  × python setup.py egg_info did not run successfully.
  │ exit code: 1
  ╰─> [5 lines of output]
      /usr/local/lib/python3.11/site-packages/setuptools/_distutils/dist.py:289: UserWarning: Unknown distribution option: 'tests_require'
        warnings.warn(msg)
      /usr/local/lib/python3.11/site-packages/setuptools/_distutils/dist.py:289: UserWarning: Unknown distribution option: 'test_suite'
        warnings.warn(msg)
      error in smart_open setup command: 'python_requires' must be a string containing valid version specifiers; Invalid specifier: '>=3.5.*'
      [end of output]
  
  note: This error originates from a subprocess, and is likely not a problem with pip.
error: metadata-generation-failed

× Encountered error while generating package metadata.
╰─> See above for output.

note: This is an issue with the package mentioned above, not pip.
hint: See above for details.

[notice] A new release of pip is available: 24.0 -> 25.3
[notice] To update, run: pip install --upgrade pip

This is a very very legacy project and has very limited exposure to the outside, so I will for now pin my version, but i hope this helps others googling :)

If you updated setuptools in your environment in any other way, you'd see the same failure. The failure is due to invalid metadata in this ancient version of smart_open. The error message tells you this. It also tells you this is an issue with the package, not with pip.

There are newer versions of smart_open. Use those.

I understand (see the various notes re "old" and "legacy" in my comment).

The point was though: Regardless of how old and legacy my setup is, it is unexpected that a patch-level release of Python breaks it.

Navigation Menu

Repository navigation

[CVE-2025-47273, CVE-2024-6345] in setuptools 67.6.1 bundled with Python 3.12 Runtime #135374

Bug report

Bug description:

CPython versions tested on:

Operating systems tested on:

Linked PRs

1 remaining item

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

[CVE-2025-47273, CVE-2024-6345] in setuptools 67.6.1 bundled with Python 3.12 Runtime #135374

Description

Bug report

Bug description:

CPython versions tested on:

Operating systems tested on:

Linked PRs

Activity

ambv commented on Jun 11, 2025

1 remaining item

mgorny commented on Jul 16, 2025

Nishi-1412 commented on Oct 1, 2025

vstinner commented on Oct 1, 2025

hugovk commented on Oct 9, 2025

ankon commented on Nov 26, 2025

ambv commented on Dec 4, 2025

ankon commented on Dec 19, 2025

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions