Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-22702: virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv's app_data and lock file operations to attacker-controlled locations. This issue has been patched in version 20.36.1.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | python3.13-virtualenv | 0:20.21.1-1.amzn2023.0.2 |
Vulnerabilities 1
-
Medium 4.5
virtualenv Has TOCTOU Vulnerabilities in Directory Creation
virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An atta…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-22702.html