maintainer-feedback requested: [Bug 298351] devel/py-setuptools: CVE-2025-47273 remains flagged in 63.1.0_3; request update or security backport Port: devel/py-setuptools Installed package: py312-setuptools-63.1.0_3 System: FreeBSD 15, amd64 Ports branch: main `pkg audit` reports that py

Bugzilla Automation <bugzilla@FreeBSD.org> has asked freebsd-python (Nobody)
<python@FreeBSD.org> for maintainer-feedback:
Bug 298351: devel/py-setuptools: CVE-2025-47273 remains flagged in 63.1.0_3;
request update or security backport  Port: devel/py-setuptools Installed
package: py312-setuptools-63.1.0_3 System: FreeBSD 15, amd64 Ports branch: main
 `pkg audit` reports that py
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298351



--- Description ---
Port: devel/py-setuptools
Installed package: py312-setuptools-63.1.0_3
System: FreeBSD 15, amd64
Ports branch: main

pkg audit reports that py312-setuptools-63.1.0_3 is affected by CVE-2025-47273,
a path traversal vulnerability in setuptools PackageIndex.

FreeBSD advisory:
https://vuxml.freebsd.org/freebsd/690144e9-4f88-11f1-982e-00a098b42aeb.html

The advisory lists setuptools versions before 78.1.1 as affected.

My local ports tree is at commit d41a573a92e8. After fetching origin/main
through commit 5e3a051d03e4, this command produced no output:

git -C /usr/ports diff HEAD..origin/main -- devel/py-setuptools

The port remains at:

PORTVERSION= 63.1.0
PORTREVISION= 3

The Makefile applies upstream patch 6653e747c3815b140156249205397ef3719581ee,
which addresses deprecated pkgutil API usage in pkg_resources. There are no
local files/patch-* files in this port. I did not find a backport of the
CVE-2025-47273 fix in the inspected port configuration.

On this system, py312-certbot-apache-4.2.0 depends on py312-setuptools, so
removing the affected package would leave an installed dependency unsatisfied.
I have not established whether normal Certbot operation exposes the vulnerable
code path.

Could the port be updated to a fixed version, or could the security fix be
backported if a major setuptools update requires broader ports compatibility
testing?

If the issue is already mitigated in this package, please clarify the
mitigation and whether the VuXML affected-version range needs adjustment.

Thank you.