CVE-2024-53899: Improper Neutralization of Special Elements used in a Command

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287...

5gasp-cli (>=0.1.0, <=0.4.0), ablator (0.0.1b3) +246 more potentially affected by CVE-2024-53899 via virtualenv (>=1.11.6, <=20.26.4)

virtualenv PYPI version =1.11.6, =0.1.0, =0.1.0, =1.0.9, =2.0.1, =0.0.1, =0.0.2, =0.2.0, =1.5.0, =2024.7.4, =0.8.3b20231012, =1.0.1b20240404 and more Source cves: CVE-2024-53899 Source advisory: MEND:CVE-2024-53899...

Virtualenv operating system command injection vulnerability

Virtualenv is an open source Python virtual environment builder from Python Packaging Authority. An operating system command injection vulnerability exists in versions prior to Virtualenv 20.26.6, which stems from the Magic template string not being referenced correctly...

CVE-2024-53899

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287...

CVE-2024-53899

CVE-2024-53899 affects python-virtualenv: versions older than 20.26.6-1 are vulnerable to command injection via activation scripts due to unquoted/magic template strings during activation. The issue is remedied in newer packages (≥ 20.26.6-1); upgrade to the patched release to mitigate. Connected...

CVE-2024-53899

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287...

Security update for python3

This update for python3 fixes the following issues: Security fixes: CVE-2024-9287: properly quote path names provided when creating a virtual environment bsc1232241 Other fixes: Drop .pyc files from docdir for reproducible builds bsc1230906 Patch Instructions: To install this SUSE update use the...

OPENSUSE-SU-2024:14426-1 python310-virtualenv-20.26.6-1.1 on GA media

These are all security issues fixed in the python310-virtualenv-20.26.6-1.1 package on the GA media of openSUSE Tumbleweed...

[SECURITY] Fedora 40 Update: python-virtualenv-20.21.1-25.fc40

virtualenv is a tool to create isolated Python environments. virtualenv is a successor to workingenv, and an extension of virtual-python. It is written by Ian Bicking, and sponsored by the Open Planning Project. It is licensed under an MIT-style permissive license...

[SECURITY] Fedora 39 Update: python-virtualenv-20.21.1-25.fc39

virtualenv is a tool to create isolated Python environments. virtualenv is a successor to workingenv, and an extension of virtual-python. It is written by Ian Bicking, and sponsored by the Open Planning Project. It is licensed under an MIT-style permissive license...

Fedora: Security Advisory (FEDORA-2024-112e897674)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2024-f7d6b76677)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 40 : python-virtualenv (2024-112e897674)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-112e897674 advisory. - Prevent command injection by quoting template strings in activation scripts Tenable has extracted the preceding description block directly from the Fedora...

Fedora 39 : python-virtualenv (2024-f7d6b76677)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-f7d6b76677 advisory. - Prevent command injection by quoting template strings in activation scripts Tenable has extracted the preceding description block directly from the Fedora...

CentOS 7 : python-virtualenv (RHSA-2020:2081)

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2081 advisory. - The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect...

PT-2024-9155

Name of the Vulnerable Software and Affected Versions: virtualenv versions prior to 20.26.6 Description: The issue is related to command injection through the activation scripts for a virtual environment in virtualenv. It is caused by the incorrect quoting of magic template strings when replacing...

RHSA-2020:2081 Red Hat Security Advisory: python-virtualenv security update

Bulletin has no description...

RHSA-2020:0851 Red Hat Security Advisory: python-virtualenv security update

Bulletin has no description...

RHSA-2022:5234 Red Hat Security Advisory: python-virtualenv security update

Bulletin has no description...

Oracle Linux 7 : python-virtualenv (ELSA-2020-2081)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-2081 advisory. - The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect...