Summary
It was discovered that Python incorrectly handled quoting path names when
using the venv module. A local attacker able to control virtual
environments could possibly use this issue to execute arbitrary code when
the virtual environment is activated.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | python3.8 | 3.8.10-0ubuntu1~20.04.13 |
| Ubuntu · 22.04 LTS 22.04:LTS | python3.10 | 3.10.12-1~22.04.7 |
| Ubuntu · 24.04 LTS 24.04:LTS | python3.12 | 3.12.3-1ubuntu0.3 |
Vulnerabilities 1
-
Medium 5.3
Virtual environment (venv) activation scripts don't quote paths
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/…
References
-
report
https://ubuntu.com/security/CVE-2024-9287