Skip to content
OpenAdvisories
Medium ALAS2-2025-2817 1 CVE

Moderate: python3 security update (Amazon Linux 2)

Published Apr 7, 2025 · Updated Apr 7, 2025

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-9287: A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2 python3 0:3.7.16-1.amzn2.0.17
Amazon Linux · 2 python3-debug 0:3.7.16-1.amzn2.0.17
Amazon Linux · 2 python3-debuginfo 0:3.7.16-1.amzn2.0.17
Amazon Linux · 2 python3-devel 0:3.7.16-1.amzn2.0.17
Amazon Linux · 2 python3-libs 0:3.7.16-1.amzn2.0.17
Amazon Linux · 2 python3-test 0:3.7.16-1.amzn2.0.17
Amazon Linux · 2 python3-tkinter 0:3.7.16-1.amzn2.0.17
Amazon Linux · 2 python3-tools 0:3.7.16-1.amzn2.0.17

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-9287.html