CVE-2022-40897

Name	CVE-2022-40897
Description	Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3876-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
setuptools (PTS)	bullseye	52.0.0-4	vulnerable
	bullseye (security)	52.0.0-4+deb11u2	fixed
	bookworm	66.1.1-1+deb12u2	fixed
	forky, sid, trixie	78.1.1-0.1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
setuptools	source	bullseye	52.0.0-4+deb11u1		DLA-3876-1
setuptools	source	(unstable)	65.6.3-1

https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be (v65.5.1)