[Bug 298351] devel/py-setuptools: CVE-2025-47273 remains flagged in 63.1.0_3; request update or security backport Port: devel/py-setuptools Installed package: py312-setuptools-63.1.0_3 System: FreeBSD 15, amd64 Ports branch: main `pkg audit` reports that py

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298351

            Bug ID: 298351
           Summary: devel/py-setuptools: CVE-2025-47273 remains flagged in
                    63.1.0_3; request update or security backport  Port:
                    devel/py-setuptools Installed package:
                    py312-setuptools-63.1.0_3 System: FreeBSD 15, amd64
                    Ports branch: main  `pkg audit` reports that py
           Product: Ports & Packages
           Version: Latest
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: Individual Port(s)
          Assignee: python@FreeBSD.org
          Reporter: gerard_seibert@outlook.com
             Flags: maintainer-feedback?(python@FreeBSD.org)
          Assignee: python@FreeBSD.org

Port: devel/py-setuptools
Installed package: py312-setuptools-63.1.0_3
System: FreeBSD 15, amd64
Ports branch: main

pkg audit reports that py312-setuptools-63.1.0_3 is affected by CVE-2025-47273,
a path traversal vulnerability in setuptools PackageIndex.

FreeBSD advisory:
https://vuxml.freebsd.org/freebsd/690144e9-4f88-11f1-982e-00a098b42aeb.html

The advisory lists setuptools versions before 78.1.1 as affected.

My local ports tree is at commit d41a573a92e8. After fetching origin/main
through commit 5e3a051d03e4, this command produced no output:

git -C /usr/ports diff HEAD..origin/main -- devel/py-setuptools

The port remains at:

PORTVERSION= 63.1.0
PORTREVISION= 3

The Makefile applies upstream patch 6653e747c3815b140156249205397ef3719581ee,
which addresses deprecated pkgutil API usage in pkg_resources. There are no
local files/patch-* files in this port. I did not find a backport of the
CVE-2025-47273 fix in the inspected port configuration.

On this system, py312-certbot-apache-4.2.0 depends on py312-setuptools, so
removing the affected package would leave an installed dependency unsatisfied.
I have not established whether normal Certbot operation exposes the vulnerable
code path.

Could the port be updated to a fixed version, or could the security fix be
backported if a major setuptools update requires broader ports compatibility
testing?

If the issue is already mitigated in this package, please clarify the
mitigation and whether the VuXML affected-version range needs adjustment.

Thank you.

-- 
You are receiving this mail because:
You are the assignee for the bug.