[GHSA-5rjg-fvgr-3xxf] setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write #5724
Conversation
|
Hi there @jaraco! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
github-actions
bot
changed the base branch from
main
to
4lp1ne/advisory-improvement-5724
|
Hi there @jaraco! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
|
Hi @4lp1ne, I'm closing the PR because I believe the CVSS that's already present in GHSA-5rjg-fvgr-3xxf is accurate and it doesn't make sense to set the severity to low/0 instead of high/7.7 Thank you for your interest in GHSA-5rjg-fvgr-3xxf and have a good day. |
Updates
Comments
Sec