Python Packaging Authority virtualenv path traversal vulnerability

The Python Packaging Authority identifies a path traversal vulnerability in virtualenv versions prior to 21.14.9. This vulnerability arises because PipInstall.uninstallpreviousversion accepts metadata from existing seed packages. Additionally, uninstalldist fails to verify whether entries within...

Python Packaging Authority virtualenv input validation error vulnerability

The Python Packaging Authority’s virtualenv versions prior to 21.14.9 have a vulnerability related to input validation. This vulnerability stems from the standard library venv creator using str.splitlines to read the generated pyvenv.cfg file and merging the parsed keys into the selected virtuale...

Python Packaging Authority virtualenv post-link vulnerability

The Python Packaging Authority identifies a post-link vulnerability in virtualenv versions prior to 21.14.9. This vulnerability arises because the built-in creator calls ensuredir when handling executable files, libraries, and package directories; it accepts existing symbolic links pointing to...

Python Packaging Authority virtualenv encryption vulnerability

The Python Packaging Authority virtualenv version 21.14.8 has a security vulnerability. This vulnerability stems from downloadwheel, which downloads the package index into a reusable cache before validating the target based on the Saved output from pip. Due to a flaw in the digest comparison, a...

Python Packaging Authority virtualenv permission and access control issue vulnerability

The Python Packaging Authority identifies a permission and access control vulnerability in virtualenv versions prior to 21.14.9. This vulnerability arises when the app-data replication seeder uses shutil.copy to copy cached package files to subsequent environments; the permission mode of the sour...

Python Packaging Authority virtualenv command injection vulnerability

The Python Packaging Authority’s virtualenv versions prior to 21.14.9 have a command injection vulnerability. This vulnerability stems from the fact that when generating POSIX console scripts, the interpreter path is passed to distlib ScriptMaker without proper referencing. When the path contains...

Python Packaging Authority virtualenv post-link vulnerability

The Python Packaging Authority’s virtualenv versions prior to 21.14.9 have a post-release vulnerability. This vulnerability stems from the handling of errors during the safedelete function’s deletion operations. When deletion fails, the error handling code uses os.lstatpath to read the file mode...

Vulnerability related to improper handling of virtualenv output by Python Packaging Authority

A security vulnerability exists in Python Packaging Authority virtualenv versions prior to 21.14.2. This vulnerability arises because FishActivator inherits from ViaTemplateActivator.quote and calls POSIX shlex.quote. However, fish interprets backslashes and single quotes differently. Attackers c...

Python Packaging Authority virtualenv software supply chain vulnerability

The Python Packaging Authority identifies a vulnerability in virtualenv versions prior to 21.14.9 within the software supply chain. This vulnerability arises when PipInvoke.getpipinstallcmd calls getwheeldownload=False during processing of --seeder pip --download, allowing pip to query the index ...

Python Packaging Authority virtualenv command injection vulnerability

The Python Packaging Authority’s virtualenv version 20.26.6 to 21.14.2 contains a security vulnerability. This vulnerability stems from ViaTemplateActivator.instantiatetemplate, which replaces placeholders in the activation template on a per-key basis. As a result, names such as VIRTUALNAME,...

Python Packaging Authority virtualenv post-link vulnerability

The Python Packaging Authority identifies a post-link vulnerability in virtualenv versions prior to 21.14.9. This vulnerability arises because ViaTemplateActivator.generate deletes existing outputs only when Path.exists returns true. As a result, empty symbolic links can persist and redirect...

Vulnerability related to improper handling of virtualenv output by Python Packaging Authority

A security vulnerability exists in Python Packaging Authority virtualenv versions prior to 21.14.4. This vulnerability stems from improper escaping of environment names in the bash activate script. When PROMPTSUBST is enabled in zsh, values such as environment directories, --prompt, or...

Python Packaging Authority virtualenv command injection vulnerability

The Python Packaging Authority’s virtualenv versions prior to 21.14.9 have a command injection vulnerability. This vulnerability arises from the prompt text provided by the caller potentially becoming executable syntax in the bash activation prompt, which can lead to command injection...

Python Packaging Authority virtualenv code injection vulnerability

The Python Packaging Authority identifies a code injection vulnerability in virtualenv versions prior to 21.14.9. This vulnerability arises because POSIX xonsh activates the quote function; however, it uses repr to write printable non-ASCII prompts or target data into UTF-8 activate.xsh. Under...

Vulnerability related to improper handling of virtualenv output by Python Packaging Authority

A security vulnerability exists in Python Packaging Authority virtualenv versions prior to 21.14.7. This vulnerability stems from incomplete escaping of environment variables in the bash activate script; backslashes can be unescaped, allowing commands to be executed in the user’s shell when names...

openSUSE 16 Security Update : python-virtualenv (openSUSE-SU-2026:22100-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22100-1 advisory. - CVE-2026-102930: missing hash verification for network-fetched wheels can allow wheel tampering bsc1283904. - CVE-2026-102938: crafted prompt...

Security update for python-virtualenv (important)

openSUSE security update: security update for python-virtualenv ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22100-1 Rating: important References: bsc1283890 bsc1283904 Cross-References: CVE-2026-102930 CVE-2026-102938 CVSS scores: CVE-2026-10293...

PT-2026-118624

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description In POSIX xonsh activation, the quote function uses repr to write non-ASCII prompt or destination data into the UTF-8 activate.xsh script. When xonsh reads this script using $XONSH ENCODING under...

PT-2026-118629

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description Caller-supplied prompt text can be converted into executable syntax within the bash activation prompt. This occurs when an attacker influences the value passed to the tool, and a user subsequent...

python36:3.6 security update

python36 3.6.8-39 - Provide /usr/bin/python3 explicitly - Resolves: RHEL-2113 python-distro 1.4.0-2 - Port from Fedora to RHEL8, part of the python36 module - Resolves: rhbz1678920 python-docs 3.6.7-2 - Bumping due to problems with modular RPM upgrade path - Resolves: rhbz1695587 python-docutils...