Security update for python-virtualenv

This update for python-virtualenv fixes the following issues: CVE-2024-53899: Fixed a command injection through activation scripts bsc1233706 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you c...

SUSE-SU-2024:4093-1 Security update for python-virtualenv

This update for python-virtualenv fixes the following issues: - CVE-2024-53899: Fixed a command injection through activation scripts bsc1233706...

BIT-VIRTUALENV-2024-53899

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287...

SUSE CVE-2024-53899

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287...

CVE-2024-53899

A flaw was found in the virtualenv Python package. Due to the improper handling of quotes in magic template strings, the virtual environment activation script is vulnerable to OS command injection,leading to the loss of confidentiality,integrity and availability of the system. Mitigation Mitigati...

pickley (1.9.19), thaispoon (0.0.1) potentially affected by CVE-2024-53899 via virtualenv (16.7.7)

virtualenv PYPI version 16.7.7 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pickley 1.9.19 - thaispoon 0.0.1 Source cves: CVE-2024-53899 Source advisory: OSV:GHSA-RQC4-2HC7-8C8V...

5gasp-cli (>=0.1.0, <=0.4.0), ablator (0.0.1b3) +211 more potentially affected by CVE-2024-53899 via virtualenv (>=20.0.9, <=20.26.4)

virtualenv PYPI version =20.0.9, =0.1.0, =0.1.0, =1.0.9, =0.0.1, =0.0.2, =0.2.0, =1.5.0, =2024.7.4, =0.8.3b20231012, =0.8.3b20231012, =1.0.1b20240404 and more Source cves: CVE-2024-53899 Source advisory: GHSA-RQC4-2HC7-8C8V...

akc-mamba (>=2.0.1, <=2.0.2), pangsitpy (0.0.3) potentially affected by CVE-2024-53899 via virtualenv (16.7.9)

virtualenv PYPI version 16.7.9 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - akc-mamba =2.0.1, =2.0.2 - pangsitpy 0.0.3 Source cves: CVE-2024-53899 Source advisory: OSV:GHSA-RQC4-2HC7-8C8V...

pip-faster (>=1.0.0rc1, <=1.0.0rc6.dev4) potentially affected by CVE-2024-53899 via virtualenv (1.11.6)

virtualenv PYPI version 1.11.6 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pip-faster =1.0.0rc1, =1.0.0rc6.dev4 Source cves: CVE-2024-53899 Source advisory: OSV:GHSA-RQC4-2HC7-8C8V...

virtualenv allows command injection through activation scripts for a virtual environment

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287...

uranium (>=0.2.8, <=0.2.22) potentially affected by CVE-2024-53899 via virtualenv (13.1.0)

virtualenv PYPI version 13.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - uranium =0.2.8, =0.2.22 Source cves: CVE-2024-53899 Source advisory: OSV:GHSA-RQC4-2HC7-8C8V...

dcoscli (>=0.1.1, <=0.1.8) potentially affected by CVE-2024-53899 via virtualenv (12.1.1)

virtualenv PYPI version 12.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - dcoscli =0.1.1, =0.1.8 Source cves: CVE-2024-53899 Source advisory: OSV:GHSA-RQC4-2HC7-8C8V...

5gasp-cli (>=0.1.0, <=0.4.0), ablator (0.0.1b3) +211 more potentially affected by CVE-2024-53899 via virtualenv (>=20.0.9, <=20.26.4)

virtualenv PYPI version =20.0.9, =0.1.0, =0.1.0, =1.0.9, =0.0.1, =0.0.2, =0.2.0, =1.5.0, =2024.7.4, =0.8.3b20231012, =0.8.3b20231012, =1.0.1b20240404 and more Source cves: CVE-2024-53899 Source advisory: OSV:GHSA-RQC4-2HC7-8C8V...

bento-cli (>=0.1.0, <=0.1.1) potentially affected by CVE-2024-53899 via virtualenv (16.7.5)

virtualenv PYPI version 16.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - bento-cli =0.1.0, =0.1.1 Source cves: CVE-2024-53899 Source advisory: OSV:GHSA-RQC4-2HC7-8C8V...

pystarter (>=1.0.0, <=1.1.2), terraenv (>=0.6.0.dev0, <=0.6.2) potentially affected by CVE-2024-53899 via virtualenv (16.1.0)

virtualenv PYPI version 16.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pystarter =1.0.0, =0.6.0.dev0, =0.6.2 Source cves: CVE-2024-53899 Source advisory: OSV:GHSA-RQC4-2HC7-8C8V...

cosmic-ray (>=6.1.1, <=8.3.5), fauxpy (>=0.1.0, <=0.7.0) +1 more potentially affected by CVE-2024-53899 via virtualenv (16.7.10)

virtualenv PYPI version 16.7.10 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cosmic-ray =6.1.1, =0.1.0, =0.7.0 - pickley 2.0.14 Source cves: CVE-2024-53899 Source advisory: OSV:GHSA-RQC4-2HC7-8C8V...

cloudmesh-client (4.2.6) potentially affected by CVE-2024-53899 via virtualenv (15.0.1)

virtualenv PYPI version 15.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cloudmesh-client 4.2.6 Source cves: CVE-2024-53899 Source advisory: OSV:GHSA-RQC4-2HC7-8C8V...

python-webex-bot (0.51.0) potentially affected by CVE-2024-53899 via virtualenv (16.4.3)

virtualenv PYPI version 16.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - python-webex-bot 0.51.0 Source cves: CVE-2024-53899 Source advisory: OSV:GHSA-RQC4-2HC7-8C8V...

ddwrt-tracker (>=0.0.1.dev33, <=0.0.1.dev34), dokos-cli (>=2.0.0, <=2.1.0) +3 more potentially affected by CVE-2024-53899 via virtualenv (16.6.0)

virtualenv PYPI version 16.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ddwrt-tracker =0.0.1.dev33, =2.0.0, =5.0.0, =0.0.0, =0.0.0, =1.9.1 Source cves: CVE-2024-53899 Source advisory: OSV:GHSA-RQC4-2HC7-8C8V...

debpackager (>=0.1.0, <=0.2.1), scriptworker (0.2.1) +1 more potentially affected by CVE-2024-53899 via virtualenv (15.0.2)

virtualenv PYPI version 15.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - debpackager =0.1.0, =0.2.35, =1.1.0 Source cves: CVE-2024-53899 Source advisory: OSV:GHSA-RQC4-2HC7-8C8V...