#21184 Vulnerability in setuptools versions up to 69.1.1 Issue created by gruzewski Describe the bug Recently, there was a new vulnerability reported against

setuptools

that could allow RCE, see reports below: • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6345 • https://ubuntu.com/security/CVE-2024-6345 The fix was deployed in version

70.0.0

. Pants version 2.21 OS Linux Additional info From browsing the code, looks Pants is using `63.x`. class Setuptools(PythonToolRequirementsBase): options_scope = "setuptools" help_short = "Python setuptools, used to package

python_distribution

targets." default_requirements = ["setuptools>=63.1.0,<64.0", "wheel>=0.35.1,<0.38"] default_lockfile_resource = ("pants.backend.python.subsystems", "setuptools.lock") pantsbuild/pants