p PatchFirst

CVE-2024-9287

CVE-2024-9287 · Virtual environment (venv) activation scripts don't quote paths

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.

CVSS 5.3 · Medium · EPSS 0.6% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • python

    Versions
    • ≥ 0, < 3.9.21: Affected (python)
    • ≥ 3.10.0, < 3.10.16: Affected (python)
    • ≥ 3.11.0, < 3.11.11: Affected (python)
    • ≥ 3.12.0, < 3.12.8: Affected (python)
    • ≥ 3.13.0, < 3.13.1: Affected (python)
    • ≥ 3.14.0a1, < 3.14.0a2: Affected (python)

    Update to 3.10.16; Update to 3.11.11; Update to 3.12.8; Update to 3.13.1; Update to 3.14.0a2; Update to 3.9.21

  • pypy3 Debian:12

    Versions
    • 7.3.11+dfsg-2
    • 7.3.11+dfsg-2+deb12u1
    • 7.3.11+dfsg-2+deb12u2
    Affected ranges
    • ECOSYSTEM: < 7.3.11+dfsg-2+deb12u3

    Update to 7.3.11+dfsg-2+deb12u3

  • pypy3 Debian:13

    Affected ranges
    • ECOSYSTEM: < 7.3.17+dfsg-3

    Update to 7.3.17+dfsg-3

  • pypy3 Debian:14

    Affected ranges
    • ECOSYSTEM: < 7.3.17+dfsg-3

    Update to 7.3.17+dfsg-3

  • python3.11 Debian:12

    Versions
    • 3.11.2-6
    • 3.11.2-6+deb12u1
    • 3.11.2-6+deb12u2
    • 3.11.2-6+deb12u3
    • 3.11.2-6+deb12u4
    Affected ranges
    • ECOSYSTEM: < 3.11.2-6+deb12u5

    Update to 3.11.2-6+deb12u5

  • python3.13 Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.13.1-1

    Update to 3.13.1-1

  • python3.13 Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.13.1-1

    Update to 3.13.1-1

  • python3.4 Ubuntu:Pro:14.04:LTS

    Versions
    • 3.4~b1-0ubuntu3
    • 3.4~b1-4ubuntu4
    • 3.4~b1-4ubuntu6
    • 3.4~b1-5ubuntu2
    • 3.4~b2-1
    • 3.4~b3-1ubuntu1
    • 3.4~rc1-1build1
    • 3.4~rc2-1
    • 3.4~rc3-0ubuntu1
    • 3.4.0-1
    • 3.4.0-2ubuntu1
    • 3.4.0-2ubuntu1.1
    • 3.4.3-1ubuntu1~14.04.1
    • 3.4.3-1ubuntu1~14.04.3
    • 3.4.3-1ubuntu1~14.04.4
    • 3.4.3-1ubuntu1~14.04.5
    • 3.4.3-1ubuntu1~14.04.6
    • 3.4.3-1ubuntu1~14.04.7
    • 3.4.3-1ubuntu1~14.04.7+esm2
    • 3.4.3-1ubuntu1~14.04.7+esm4
    • 3.4.3-1ubuntu1~14.04.7+esm6
    • 3.4.3-1ubuntu1~14.04.7+esm7
    • 3.4.3-1ubuntu1~14.04.7+esm8
    • 3.4.3-1ubuntu1~14.04.7+esm10
    • 3.4.3-1ubuntu1~14.04.7+esm11
    • 3.4.3-1ubuntu1~14.04.7+esm12
    • 3.4.3-1ubuntu1~14.04.7+esm13
    Affected ranges
    • ECOSYSTEM: < 3.4.3-1ubuntu1~14.04.7+esm14

    Update to 3.4.3-1ubuntu1~14.04.7+esm14

  • python3.5 Ubuntu:Pro:14.04:LTS

    Versions
    • 3.5.2-2ubuntu0~16.04.4~14.04.1
    • 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1
    • 3.5.2-2ubuntu0~16.04.4~14.04.1+esm3
    Affected ranges
    • ECOSYSTEM: < 3.5.2-2ubuntu0~16.04.4~14.04.1+esm4

    Update to 3.5.2-2ubuntu0~16.04.4~14.04.1+esm4

  • python3.5 Ubuntu:Pro:16.04:LTS

    Versions
    • 3.5.0-3
    • 3.5.0-3ubuntu1
    • 3.5.1~rc1-2ubuntu1
    • 3.5.1-1
    • 3.5.1-2
    • 3.5.1-3
    • 3.5.1-5
    • 3.5.1-6ubuntu1
    • 3.5.1-6ubuntu2
    • 3.5.1-9ubuntu1
    • 3.5.1-10
    • 3.5.2-2~16.01
    • 3.5.2-2~16.04
    • 3.5.2-2ubuntu0~16.04.1
    • 3.5.2-2ubuntu0~16.04.2
    • 3.5.2-2ubuntu0~16.04.3
    • 3.5.2-2ubuntu0~16.04.4
    • 3.5.2-2ubuntu0~16.04.5
    • 3.5.2-2ubuntu0~16.04.8
    • 3.5.2-2ubuntu0~16.04.9
    • 3.5.2-2ubuntu0~16.04.10
    • 3.5.2-2ubuntu0~16.04.11
    • 3.5.2-2ubuntu0~16.04.12
    • 3.5.2-2ubuntu0~16.04.13
    • 3.5.2-2ubuntu0~16.04.13+esm1
    • 3.5.2-2ubuntu0~16.04.13+esm2
    • 3.5.2-2ubuntu0~16.04.13+esm3
    • 3.5.2-2ubuntu0~16.04.13+esm5
    • 3.5.2-2ubuntu0~16.04.13+esm6
    • 3.5.2-2ubuntu0~16.04.13+esm7
    • 3.5.2-2ubuntu0~16.04.13+esm8
    • 3.5.2-2ubuntu0~16.04.13+esm9
    • 3.5.2-2ubuntu0~16.04.13+esm10
    • 3.5.2-2ubuntu0~16.04.13+esm11
    • 3.5.2-2ubuntu0~16.04.13+esm12
    • 3.5.2-2ubuntu0~16.04.13+esm13
    • 3.5.2-2ubuntu0~16.04.13+esm14
    • 3.5.2-2ubuntu0~16.04.13+esm15
    Affected ranges
    • ECOSYSTEM: < 3.5.2-2ubuntu0~16.04.13+esm16

    Update to 3.5.2-2ubuntu0~16.04.13+esm16

  • python3.6 Ubuntu:Pro:18.04:LTS

    Versions
    • 3.6.3-1ubuntu1
    • 3.6.4~rc1-1
    • 3.6.4~rc1-2
    • 3.6.4-1
    • 3.6.4-2
    • 3.6.4-3build1
    • 3.6.4-4
    • 3.6.5~rc1-1
    • 3.6.5-3
    • 3.6.6-1~18.04
    • 3.6.7-1~18.04
    • 3.6.8-1~18.04.1
    • 3.6.8-1~18.04.2
    • 3.6.8-1~18.04.3
    • 3.6.9-1~18.04
    • 3.6.9-1~18.04ubuntu1
    • 3.6.9-1~18.04ubuntu1.1
    • 3.6.9-1~18.04ubuntu1.3
    • 3.6.9-1~18.04ubuntu1.4
    • 3.6.9-1~18.04ubuntu1.6
    • 3.6.9-1~18.04ubuntu1.7
    • 3.6.9-1~18.04ubuntu1.8
    • 3.6.9-1~18.04ubuntu1.9
    • 3.6.9-1~18.04ubuntu1.10
    • 3.6.9-1~18.04ubuntu1.12
    • 3.6.9-1~18.04ubuntu1.13
    • 3.6.9-1~18.04ubuntu1.13+esm1
    • 3.6.9-1~18.04ubuntu1.13+esm2
    Affected ranges
    • ECOSYSTEM: < 3.6.9-1~18.04ubuntu1.13+esm3

    Update to 3.6.9-1~18.04ubuntu1.13+esm3

  • python3.7 Ubuntu:Pro:18.04:LTS

    Versions
    • 3.7.0~a2-1
    • 3.7.0~a3-1
    • 3.7.0~a3-2
    • 3.7.0~a3-3
    • 3.7.0~a4-1
    • 3.7.0~b1-1
    • 3.7.0~b1-1build1
    • 3.7.0~b2-1
    • 3.7.0~b3-1
    • 3.7.0-1~18.04
    • 3.7.1-1~18.04
    • 3.7.3-2~18.04.1
    • 3.7.5-2~18.04
    • 3.7.5-2~18.04.4
    • 3.7.5-2ubuntu1~18.04.2
    • 3.7.5-2ubuntu1~18.04.2+esm1
    • 3.7.5-2ubuntu1~18.04.2+esm2
    • 3.7.5-2ubuntu1~18.04.2+esm3
    Affected ranges
    • ECOSYSTEM: < 3.7.5-2ubuntu1~18.04.2+esm4

    Update to 3.7.5-2ubuntu1~18.04.2+esm4

  • python3.8 Ubuntu:Pro:18.04:LTS

    Versions
    • 3.8.0-3~18.04
    • 3.8.0-3~18.04.1
    • 3.8.0-3ubuntu1~18.04.2
    • 3.8.0-3ubuntu1~18.04.2+esm1
    • 3.8.0-3ubuntu1~18.04.2+esm2
    Affected ranges
    • ECOSYSTEM: < 3.8.0-3ubuntu1~18.04.2+esm3

    Update to 3.8.0-3ubuntu1~18.04.2+esm3

  • python3.8 Ubuntu:20.04:LTS

    Versions
    • 3.8.0-1
    • 3.8.0-2
    • 3.8.0-3
    • 3.8.0-4
    • 3.8.0-5
    • 3.8.1-2ubuntu3
    • 3.8.2~rc1-1ubuntu1
    • 3.8.2-1
    • 3.8.2-1ubuntu1
    • 3.8.2-1ubuntu1.1
    • 3.8.2-1ubuntu1.2
    • 3.8.5-1~20.04
    • 3.8.5-1~20.04.2
    • 3.8.5-1~20.04.3
    • 3.8.10-0ubuntu1~20.04
    • 3.8.10-0ubuntu1~20.04.1
    • 3.8.10-0ubuntu1~20.04.2
    • 3.8.10-0ubuntu1~20.04.4
    • 3.8.10-0ubuntu1~20.04.5
    • 3.8.10-0ubuntu1~20.04.6
    • 3.8.10-0ubuntu1~20.04.7
    • 3.8.10-0ubuntu1~20.04.8
    • 3.8.10-0ubuntu1~20.04.9
    • 3.8.10-0ubuntu1~20.04.10
    • 3.8.10-0ubuntu1~20.04.11
    • 3.8.10-0ubuntu1~20.04.12
    • 3.8.10-0ubuntu1~20.04.13
    • 3.8.10-0ubuntu1~20.04.14
    • 3.8.10-0ubuntu1~20.04.15
    Affected ranges
    • ECOSYSTEM: < 3.8.10-0ubuntu1~20.04.16

    Update to 3.8.10-0ubuntu1~20.04.16

  • python3.9 Ubuntu:Pro:20.04:LTS

    Versions
    • 3.9.0~rc1-1~20.04
    • 3.9.0-5~20.04
    • 3.9.5-3~20.04.1
    • 3.9.5-3ubuntu0~20.04.1
    • 3.9.5-3ubuntu0~20.04.1+esm1
    • 3.9.5-3ubuntu0~20.04.1+esm2
    Affected ranges
    • ECOSYSTEM: < 3.9.5-3ubuntu0~20.04.1+esm3

    Update to 3.9.5-3ubuntu0~20.04.1+esm3

  • python3.10 Ubuntu:22.04:LTS

    Versions
    • 3.10.0-2
    • 3.10.0-3
    • 3.10.0-4
    • 3.10.0-5
    • 3.10.0-5build1
    • 3.10.1-1
    • 3.10.1-2
    • 3.10.2-1
    • 3.10.2-5
    • 3.10.2-7
    • 3.10.3-1
    • 3.10.4-3
    • 3.10.4-3ubuntu0.1
    • 3.10.6-1~22.04
    • 3.10.6-1~22.04.1
    • 3.10.6-1~22.04.2
    • 3.10.6-1~22.04.2ubuntu1
    • 3.10.6-1~22.04.2ubuntu1.1
    • 3.10.12-1~22.04.2
    • 3.10.12-1~22.04.3
    • 3.10.12-1~22.04.4
    • 3.10.12-1~22.04.5
    • 3.10.12-1~22.04.6
    Affected ranges
    • ECOSYSTEM: < 3.10.12-1~22.04.7

    Update to 3.10.12-1~22.04.7

  • python3.11 Ubuntu:Pro:22.04:LTS

    Versions
    • 3.11.0~rc1-1~22.04
    • 3.11.0~rc1-1~22.04.1~esm1
    Affected ranges
    • ECOSYSTEM: < 3.11.0~rc1-1~22.04.1~esm2

    Update to 3.11.0~rc1-1~22.04.1~esm2

  • python3.12 Ubuntu:24.04:LTS

    Versions
    • 3.12.0-1
    • 3.12.0-5
    • 3.12.0-6
    • 3.12.0-7
    • 3.12.1-2
    • 3.12.2-1
    • 3.12.2-4build3
    • 3.12.2-4build4
    • 3.12.2-5ubuntu3
    • 3.12.3-1
    • 3.12.3-1ubuntu0.1
    • 3.12.3-1ubuntu0.2
    Affected ranges
    • ECOSYSTEM: < 3.12.3-1ubuntu0.3

    Update to 3.12.3-1ubuntu0.3

Original sources

Check your server →