High ELSA-2024-11048 1 CVE

Important: python-virtualenv security update (Oracle Linux 7)

Published Jan 10, 2025 · Updated Jan 10, 2025

Ecosystem: Oracle Linux

Summary

[15.1.0-7.0.1]
- Fixes CVE-2024-53899 Quote template strings in activation scripts [Orabug: 37396464]

Fixed packages 1

Release	Package	Fixed in
Oracle Linux · 7	python-virtualenv	0:15.1.0-7.0.1.el7_9

Vulnerabilities 1

High 8.4

CVE-2024-53899

virtualenv allows command injection through activation scripts for a virtual environment

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

py3-cassandra-medusa python-virtualenv py3-cassandra-medusa-compat virtualenv Debian Ubuntu Azure Linux Wolfi PyPI

Nov 24, 2024