Vulnerability in Python 3.10 (setuptools inside ensurepip folder)

[bhupendra-vaishnav]

Bug report

Bug description:

We are working on Python 3.10 and found vulnerable version of setuptools package which is setuptools-65.5.0.

We did see Python 3.10 already has a fix for setuptools package and updated version of setuptools package which is setuptools-65.5.1. Though while doing analysis, we found the traces of vulnerable version inside ensurepip folder. We appreciate the update for ensurepip bundle to resolve the issue related to leftover file in ensurepip bundle (highlighted in below image).

Please refer absolute file paths highlighted by blue in attached screenshot :

Vulnerability reference : GHSA-r9hx-vwmv-q579

CC: @samruddhikhandale, @eljog, @gauravsaini04

CPython versions tested on:

3.10

Operating systems tested on:

Linux

[samruddhikhandale]

We opened a similar issue with docker-library/python#901, but turns out the vulnerability comes from Python's own stdlib.

We would appreciate a fix as this is a high severity vulnerability, thank you!

[hugovk]

Thanks for the report, this is a duplicate of #102202.