REDHAT-BUG-2321440
First published: Thu Oct 24 2024(Updated: )
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| CPython |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/python/cpython/issues/124651
- https://access.redhat.com/errata/RHSA-2024:10779
- https://access.redhat.com/errata/RHSA-2024:10978
- https://access.redhat.com/errata/RHSA-2024:10979
- https://access.redhat.com/errata/RHSA-2024:10980
- https://access.redhat.com/errata/RHSA-2024:10983
- https://access.redhat.com/errata/RHSA-2024:11024
- https://access.redhat.com/errata/RHSA-2024:11035
- https://access.redhat.com/errata/RHSA-2024:11111
- https://access.redhat.com/errata/RHSA-2025:0280
- https://bugzilla.redhat.com/show_bug.cgi?id=2321440
Frequently Asked Questions
What is the severity of REDHAT-BUG-2321440?
The severity of REDHAT-BUG-2321440 is considered high due to the potential for command injection in virtual environment activation scripts.
How do I fix REDHAT-BUG-2321440?
To fix REDHAT-BUG-2321440, ensure you upgrade to the patched version of CPython that addresses the quoting issue in the venv module.
What versions of CPython are affected by REDHAT-BUG-2321440?
REDHAT-BUG-2321440 affects all versions of CPython that utilize the venv module without proper path quoting.
What kind of attacks can REDHAT-BUG-2321440 enable?
REDHAT-BUG-2321440 can enable attackers to execute arbitrary commands through the manipulation of virtual environment activation scripts.
Is there a workaround for REDHAT-BUG-2321440 before applying a patch?
A temporary workaround for REDHAT-BUG-2321440 involves manually sanitizing and verifying path inputs when creating virtual environments.
- agent/severity
- agent/type
- agent/description
- agent/event
- agent/first-publish-date
- agent/trending
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-9287
- agent/references
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/python
- canonical/cpython