Red Hat Security Advisory: python-virtualenv security update

Fixed packages 1

Vulnerabilities 1

• High 8.4
  CVE-2024-53899

  virtualenv allows command injection through activation scripts for a virtual environment

  virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

  py3-cassandra-medusa python-virtualenv py3-cassandra-medusa-compat virtualenv Debian Ubuntu Azure Linux Wolfi PyPI
  Nov 24, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2328554
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11048.json
• report
  https://access.redhat.com/security/cve/CVE-2024-53899
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-53899
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-53899
• article
  https://github.com/pypa/virtualenv/issues/2768
• article
  https://github.com/pypa/virtualenv/pull/2771
• article
  https://github.com/pypa/virtualenv/releases/tag/20.26.6