CVE-2024-9287 Virtual environment (venv) activation scripts don't quote paths

🗓️ 22 Oct 2024 16:39:34Reported by PSFType

Insecure `venv` activation script path vulnerability in CPytho

Reporter	Title	Published	Views	Family All 141
OSV	Security update for python311	8 Nov 202415:25	–	osv
OSV	CGA-37j6-2h92-vmg9	4 Nov 202417:21	–	osv
OSV	UBUNTU-CVE-2024-9287	22 Oct 202417:15	–	osv
OSV	Red Hat Security Advisory: python3.11 security update	18 Dec 202410:05	–	osv
OSV	python310-3.10.15-2.1 on GA media	25 Oct 202400:00	–	osv
OSV	Security update for python312	9 Jan 202515:36	–	osv
OSV	Moderate: python3.11 security update	19 Dec 202404:18	–	osv
OSV	Security update for python3	28 Oct 202403:33	–	osv
OSV	python310-virtualenv-20.26.6-1.1 on GA media	25 Oct 202400:00	–	osv
OSV	python39-3.9.20-4.1 on GA media	25 Oct 202400:00	–	osv

[
  {
    "cpes": [
      "cpe:2.3:a:python:cpython:*:*:*:*:*:*:*:*"
    ],
    "vendor": "python",
    "product": "cpython",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "python",
        "lessThanOrEqual": "3.13.0"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
github	www.github.com/python/cpython/pull/124712
github	www.github.com/python/cpython/commit/8450b2482586857d689b6658f08de9c8179af7db
mail	www.mail.python.org/archives/list/[email protected]/thread/RSPJ2B5JL22FG3TKUJ7D7DQ4N5JRRBZL/
github	www.github.com/python/cpython/commit/ae961ae94bf19c8f8c7fbea3d1c25cc55ce8ae97
github	www.github.com/python/cpython/commit/633555735a023d3e4d92ba31da35b1205f9ecbd7
github	www.github.com/python/cpython/commit/e52095a0c1005a87eed2276af7a1f2f66e2b6483
github	www.github.com/python/cpython/issues/124651
github	www.github.com/python/cpython/commit/9286ab3a107ea41bd3f3c3682ce2512692bdded8

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo