CVE-2024-53899

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

Virtualenv is a tool to create isolated Python environments. Since Python 3.3, a subset of it has been integrated into the standard library under the venv module. Note though, that the venv module does not offer all features of this library (e.g. cannot create bootstrap scripts, cannot create virtual environments for other python versions than the host python, not relocatable, etc.). Tools in general as such still may prefer using virtualenv for its ease of upgrading (via pip), unified handling of different Python versions and some more advanced features.

Security Fix(es):

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.(CVE-2024-53899)

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

Root has patched CVE-2024-53899 in the rootio-virtualenv package for Root:PyPI. Multiple fixed versions available.

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• virtualenv: potential command injection via virtual environment activation scripts (CVE-2024-53899)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

• CVE-2024-53899: Quote template strings in activation scripts

• CVE-2024-53899: Quote template strings in activation scripts

• Additional fix for CVE-2024-53899: quote the activate.csh values for csh, so a backslash before a quote cannot end the literal under tcsh's backslash_quote and a ! cannot trigger history expansion

• Additional fix for CVE-2024-53899: substitute the activation script placeholders in one pass, so a placeholder name inside a path cannot break the quoting
• Additional fix for CVE-2024-53899: keep the environment name from running as a command from the shell prompt in bash, POSIX-mode bash and zsh
• Additional fix for CVE-2024-53899: quote the activate.fish values for fish, so a backslash before a quote cannot end the literal

• Additional fix for CVE-2024-53899: substitute the activation script placeholders in one pass, so a placeholder name inside a path cannot break the quoting
• Additional fix for CVE-2024-53899: keep the environment name from running as a command from the shell prompt in bash, POSIX-mode bash and zsh
• Additional fix for CVE-2024-53899: quote the activate.fish values for fish, so a backslash before a quote cannot end the literal

These are all security issues fixed in the oci-cli-3.61.0-1.1 package on the GA media of openSUSE Tumbleweed.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• virtualenv: potential command injection via virtual environment activation scripts (CVE-2024-53899)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for python-virtualenv fixes the following issues:

• CVE-2024-53899: Fixed a command injection through activation scripts (bsc#1233706)

This update for python3-virtualenv fixes the following issues:

Security issue fixed:

• CVE-2024-53899: Fixed a command injection through activation scripts (bsc#1233706)

Non-security issue fixed:

• Relax version requirements that cannot be provided (bsc#1232072)

It was discovered that virtualenv incorrectly handled paths when activating virtual environments. An attacker could possibly use this issue to execute arbitrary code.

USN-7271-1 fixed a vulnerability in virtualenv. This update provides the corresponding updates for Ubuntu 24.04 LTS.

Original advisory details:

It was discovered that virtualenv incorrectly handled paths when activating virtual environments. An attacker could possibly use this issue to execute arbitrary code.