CVE-2022-40897

High

Advisory

Published 23 Dec 2022In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.026; 85th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 765; of 17,787 indexed, latest versions
Container images: 794; deployed by those charts
Fix available: 14 of 14; affected packages

pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS)

Carried by container images the latest versions of 765 of 17,787 indexed charts deploy, on 794 images.

Affected package	Affected versions	Fixed in	Images
setuptoolspypi	0.9.8, 20.7.0, 20.8.0, 29.0.1.post20161130+84 more	65.5.1	763
python-setuptoolsrpm	39.2.0-5.el8, 39.2.0-6.el8	0:39.2.0-6.el8_7.1	62
setuptoolsdeb	45.2.0-1, 59.6.0-1.2	45.2.0-1ubuntu0.1, 59.6.0-1.2ubuntu0.22.04.1	53
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+7 more	1.5.4-1ubuntu4+esm2, 8.1.1-2ubuntu0.6+esm3, 9.0.1-2.3~ubuntu1.18.04.6, 20.0.2-5ubuntu1.7+1 more	52
python-setuptoolsdeb	3.3-1ubuntu1, 3.3-1ubuntu2, 20.7.0-1, 39.0.1-2+1 more	3.3-1ubuntu2+esm1, 20.7.0-1ubuntu0.1~esm1, 39.0.1-2ubuntu0.1, 44.0.0-2ubuntu0.1	34
python3x-setuptoolsrpm	41.6.0-5.module+el8.5.0+12205+a865257a, 50.3.2-4.module+el8.5.0+12204+54860423	0:50.3.2-5.module+el8.8.0+21635+a173a6fa	6
python39rpm	3.9.16-1.module+el8.8.0+18968+3d7b19f0.1	0:3.9.16-1.module+el8.8.0+20025+f2100191.2	5
python-chardetrpm	3.0.4-7.el8	0:3.0.4-19.module+el8.4.0+9822+20bf1249	3
python-idnarpm	2.5-5.el8	0:2.10-3.module+el8.4.0+9822+20bf1249	3
python-pysocksrpm	1.6.8-3.el8	0:1.7.1-4.module+el8.4.0+9822+20bf1249	3
python-requestsrpm	2.20.0-2.1.el8_1, 2.20.0-3.el8_8	0:2.25.0-2.module+el8.4.0+9822+20bf1249	3
python-urllib3rpm	1.24.2-5.el8	0:1.25.10-4.module+el8.5.0+11712+ea2d2be1	3
python3x-piprpm	19.3.1-6.module+el8.7.0+15823+8950cfa7	0:20.2.4-7.module+el8.6.0+13003+6bb2c488	1
python-plyrpm	3.9-9.el8	0:3.11-10.module+el8.4.0+9822+20bf1249	1

OSV records: GHSA-r9hx-vwmv-q579 RHSA-2023:0835 RHSA-2024:4421 UBUNTU-CVE-2022-40897
Also known as: BIT-setuptools-2022-40897, PYSEC-2022-43012, RHSA-2023:7395, USN-5817-1

Charts affected

765 by stars

Chart

Latest

Affected images

Radar Score

minio-standalonewenerme

1.0.2

1 of 1 See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2022-40897.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2022-01-04T07-41-07Z	1484c87239ea	setuptools@39.2.0 python-setuptools@39.2.0-6.el8	65.5.1 0:39.2.0-6.el8_7.1

Open the chart page →

6,138

sambawenerme

1.0.0

1 of 1 See more

samba wenerme 1.0.0

1 of the 1 container images this version deploys carry CVE-2022-40897.

Container image	Digest	Package	Fixed in
wener/samba :4.13.3	9a42bae466d4	setuptools@51.3.3	65.5.1

Open the chart page →

2,555

temporalwenerme

0.15.1

1 of 13 See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2022-40897.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.15.1	35034611d981	setuptools@44.1.1	65.5.1

Open the chart page →

22,665

ceph-csi-cephfswikimedia

0.1.8

1 of 5 See more

ceph-csi-cephfs wikimedia 0.1.8

1 of the 5 container images this version deploys carry CVE-2022-40897.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	setuptools@39.2.0	65.5.1

Open the chart page →

10,286

ceph-csi-rbdwikimedia

0.1.13

1 of 6 See more

ceph-csi-rbd wikimedia 0.1.13

1 of the 6 container images this version deploys carry CVE-2022-40897.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	setuptools@39.2.0	65.5.1

Open the chart page →

11,785

docker-hub-rate-limit-exporterwiremind

0.3.0

1 of 1 See more

docker-hub-rate-limit-exporter wiremind 0.3.0

1 of the 1 container images this version deploys carry CVE-2022-40897.

Container image	Digest	Package	Fixed in
viadee/docker-hub-rate-limit-exporter :version-1.5	2e27e3b3ee56	setuptools@52.0.0	65.5.1

Open the chart page →

1,843

pypiwiremind

0.2.1

1 of 1 See more

pypi wiremind 0.2.1

1 of the 1 container images this version deploys carry CVE-2022-40897.

Container image	Digest	Package	Fixed in
codekoala/pypi :1.2.1	4a999b2cfff2	setuptools@29.0.1.post20161130	65.5.1

Open the chart page →

423

opendistro-eswitcom-gmbh

1.13.3

1 of 3 See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry CVE-2022-40897.

Container image	Digest	Package	Fixed in
amazon/opendistro-for-elasticsearch :1.13.3	2acfa1dcc5f8	setuptools@0.9.8	65.5.1

Open the chart page →

5,807

powerdnsadminwitcom-gmbh

0.3.4

1 of 1 See more

powerdnsadmin witcom-gmbh 0.3.4

1 of the 1 container images this version deploys carry CVE-2022-40897.

Container image	Digest	Package	Fixed in
ngoduykhanh/powerdns-admin :v0.2.4	ba36ab196d3d	setuptools@51.3.3	65.5.1

Open the chart page →

2,643

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2022-40897.

Container image	Digest	Package	Fixed in
quay.io/maximilianopizarro/workshop-pipelines :latest	e383ba3e0966	setuptools@39.2.0 python-setuptools@39.2.0-6.el8	65.5.1 0:39.2.0-6.el8_7.1

Open the chart page →

11,592

xkopsxkops

0.1.0

2 of 5 See more

xkops xkops 0.1.0

2 of the 5 container images this version deploys carry CVE-2022-40897.

Container image	Digest	Package	Fixed in
hamzaarshad10/querybackend :1.6.2	2c1c3b86a8e7	setuptools@58.1.0	65.5.1
murtazashah46/helmfile :latest	4d11726cf803	setuptools@58.1.0	65.5.1

Open the chart page →

13,197

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2022-40897.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	setuptools@39.2.0 python-setuptools@39.2.0-6.el8	65.5.1 0:39.2.0-6.el8_7.1

Open the chart page →

6,016

sockpuppetbrowserzekker6

0.1.0

1 of 1 See more

sockpuppetbrowser zekker6 0.1.0

1 of the 1 container images this version deploys carry CVE-2022-40897.

Container image	Digest	Package	Fixed in
dgtlmoon/sockpuppetbrowser :latest	f166a963b550	setuptools@65.5.0	65.5.1

Open the chart page →

1,588

alertmanager-matrix-forwarderzloi-space

1.0.1

1 of 2 See more

alertmanager-matrix-forwarder zloi-space 1.0.1

1 of the 2 container images this version deploys carry CVE-2022-40897.

Container image	Digest	Package	Fixed in
matrixdotorg/pantalaimon :v0.10.4	ba6a587fa508	setuptools@57.5.0	65.5.1

Open the chart page →

3,118

grafana-matrix-forwarderzloi-space

1.0.0

1 of 2 See more

grafana-matrix-forwarder zloi-space 1.0.0

1 of the 2 container images this version deploys carry CVE-2022-40897.

Container image	Digest	Package	Fixed in
matrixdotorg/pantalaimon :v0.10.4	ba6a587fa508	setuptools@57.5.0	65.5.1

Open the chart page →

1,636

Container images carrying it

794 by charts deploying them

A fixed version is listed for 14 of the 14 affected packages.

Container image	Digest	Package	Fixed in	Used by
socialmediamacroscope/preprocessing :0.1.3	ca863306314b	setuptools@57.5.0	65.5.1	1
socialmediamacroscope/screen_name_prompt :0.1.2	724f3f5702e0	setuptools@57.5.0	65.5.1	1
socialmediamacroscope/topic_modeling :0.1.3	fa490acac2f8	setuptools@57.5.0	65.5.1	1
softonic/gar-exporter :0.2.1	a64d6c0e0ae5	setuptools@50.3.2	65.5.1	1
softonic/mysql-backup :0.4.0	d9487a8dd70f	setuptools@40.6.2	65.5.1	1
someblackmagic/k8s-testing-multitool :v0.1.0	6eca64b6b440	setuptools@45.2.0 python-pip@20.0.2-5ubuntu1.6 setuptools@45.2.0-1	65.5.1 20.0.2-5ubuntu1.7 45.2.0-1ubuntu0.1	1
sonatype/nexus :oss	6bc88b51d4d7	setuptools@0.9.8	65.5.1	1
sonatype/nexus3 :3.53.0	4bd975493104	setuptools@39.2.0	65.5.1	1
sonatype/nexus3 :3.58.1	586060431b64	setuptools@39.2.0	65.5.1	1
splunk/splunk-operator :2.0.0	c4e0d3146226	setuptools@39.2.0 python-setuptools@39.2.0-6.el8	65.5.1 0:39.2.0-6.el8_7.1	1
sslhep/servicex-did-finder :v1.8.5	ab0090083567	setuptools@53.0.0	65.5.1	1
sslhep/x509-secrets :v1.8.5	d9e9ecb12d59	setuptools@53.0.0	65.5.1	1
stackstorm/st2actionrunner :3.8	88235ba70cad	setuptools@51.3.3	65.5.1	1
stackstorm/st2api :3.8	6f56d239d280	setuptools@51.3.3	65.5.1	1
stackstorm/st2auth :3.8	33ecfda16608	setuptools@51.3.3	65.5.1	1
stackstorm/st2garbagecollector :3.8	4e3f8c7ca52d	setuptools@51.3.3	65.5.1	1
stackstorm/st2notifier :3.8	f190a6212195	setuptools@51.3.3	65.5.1	1
stackstorm/st2rulesengine :3.8	259503496ff9	setuptools@51.3.3	65.5.1	1
stackstorm/st2scheduler :3.8	b1de2055c362	setuptools@51.3.3	65.5.1	1
stackstorm/st2sensorcontainer :3.8	b1a338f64773	setuptools@51.3.3	65.5.1	1
stackstorm/st2stream :3.8	1c8904a3bf67	setuptools@51.3.3	65.5.1	1
stackstorm/st2timersengine :3.8	1bf35bfaf00c	setuptools@51.3.3	65.5.1	1
stackstorm/st2workflowengine :3.8	19fdfffdbba8	setuptools@51.3.3	65.5.1	1
stakater/descheduler :v0.3.0	a47e96ebb285	setuptools@37.0.0	65.5.1	1
stakater/restful-distributed-lock-manager :0.5.3	4f8e409f30c2	setuptools@38.5.2	65.5.1	1
stakewiselabs/bls-horcrux :v1.0.0	2afd0c0b34cb	setuptools@52.0.0	65.5.1	1
stashapp/stash :latest	24dbd7607174	setuptools@45.2.0-1	45.2.0-1ubuntu0.1	1
statcan/ckan :2.9	3921305425b8	setuptools@45.2.0 python-pip@20.0.2-5ubuntu1.5 setuptools@45.2.0-1	65.5.1 20.0.2-5ubuntu1.7 45.2.0-1ubuntu0.1	1
stratospire/activityrelay :0.2.3	a4c34cb01117	setuptools@57.5.0	65.5.1	1
streamnative/apache-pulsar-grafana-dashboard-k8s :0.0.16	11bceacec8fb	setuptools@45.2.0 python-pip@20.0.2-5ubuntu1.5 setuptools@45.2.0-1	65.5.1 20.0.2-5ubuntu1.7 45.2.0-1ubuntu0.1	1
streamnative/apache-pulsar-grafana-dashboard-k8s :0.0.10	ebcf7f033b54	setuptools@41.1.0	65.5.1	1
surajwarbhe/grafana :v1	85248611e9f1	setuptools@39.2.0	65.5.1	1
svtechnmaa/svtech_csv :v1.0.1	b9d7ecf8de24	setuptools@49.3.1	65.5.1	1
svtechnmaa/svtech_icinga2 :v1.1.6	67be2aba9436	setuptools@40.8.0	65.5.1	1
svtechnmaa/svtech_postfix :v1.0.2	d5327df8b8a2	setuptools@51.3.3	65.5.1	1
svtechnmaa/svtech_rundeck_option_provider :v1.1.1	674fad30a51f	setuptools@49.3.1	65.5.1	1
swisscomcloud/esc-vm-scheduler-web :latest	b6639d1a922e	setuptools@65.5.0	65.5.1	1
t3nde/gtmetrix-bq :0.2.0	d2939e9a719b	setuptools@46.1.3	65.5.1	1
tachyongroup/mlflow-deployment-controller :mlflow-controller-0.1.8	7e79b9000856	setuptools@57.5.0	65.5.1	1
tachyongroup/mlflow-deployment-controller-ui :mlflow-controller-0.1.8	f4f7fabe1037	setuptools@58.0.4	65.5.1	1
taemon1337/image-api :0.0.1	247bc1dc4f07	setuptools@57.5.0	65.5.1	1
taigaio/taiga-back :6.4.2	9f97323cc150	setuptools@57.5.0	65.5.1	1
taigaio/taiga-protected :6.4.0	36318831b3e7	setuptools@47.1.0	65.5.1	1
tautulli/tautulli :v2.7.7	c4da15f058ea	setuptools@57.4.0	65.5.1	1
temporalio/admin-tools :1.22.4	258958fe2ff2	setuptools@65.5.0	65.5.1	1
temporalio/admin-tools :1.15.1	35034611d981	setuptools@44.1.1	65.5.1	1
temporalio/admin-tools :1.26.2	37e2e33dbd7b	setuptools@65.5.0	65.5.1	1
temporalio/admin-tools :1.22.0	836af062af30	setuptools@65.5.0	65.5.1	1
temporalio/admin-tools :1.25.0-tctl-1.18.1-cli-1.0.0	cda4901bab53	setuptools@65.5.0	65.5.1	1
tenableofficial/nessus :latest	c88e43fe1a8c	setuptools@39.2.0	65.5.1	1