python-virtualenv vulnerabilities (openSUSE)
16 vulnerabilities.
-
python-virtualenvopenSUSE virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9) 7.1 High -
python-virtualenvopenSUSE virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST 7.8 High -
python-virtualenvopenSUSE virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote 7.8 High -
python-virtualenvopenSUSE virtualenv: Deletion recovery can change a symlink target's mode 4.5 Medium -
python-virtualenvopenSUSE virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax 7.8 High -
python-virtualenvopenSUSE virtualenv: Seeded files retain permissions from an older cache 4.4 Medium -
python-virtualenvopenSUSE virtualenv: Xonsh activation literals depend on the script decoding codec 7.1 High -
python-virtualenvopenSUSE virtualenv: Builtin creation follows linked environment directories 4.5 Medium -
python-virtualenvopenSUSE virtualenv: Downloaded wheel selection and caching precede verification 2.3 Low -
python-virtualenvopenSUSE virtualenv bash and fish activation scripts execute commands embedded in paths 7.8 High -
python-virtualenvopenSUSE virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use 7.7 High -
python-virtualenvopenSUSE virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection 5.8 Medium -
python-virtualenvopenSUSE virtualenv Has TOCTOU Vulnerabilities in Directory Creation 4.5 Medium -
python-virtualenvopenSUSE filelock has TOCTOU race condition that allows symlink attacks during lock file creation 6.3 Medium -
python-virtualenvopenSUSE virtualenv allows command injection through activation scripts for a virtual environment 7.8 High -
python-virtualenvopenSUSE Virtual environment (venv) activation scripts don't quote paths 5.3 Medium