Description
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Python Software Foundation | CPython | < 3.9.21, 3.10.0 – < 3.10.16, 3.11.0 – < 3.11.11, 3.12.0 – < 3.12.8, 3.13.0 – < 3.13.1, 3.14.0a1 – < 3.14.0a2 | 3.9.21 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pypy3 | 7.3.17+dfsg-3 | — |
| Debian 13 | pypy3 | 7.3.17+dfsg-3 | — |
| Debian 13 | python3.13 | 3.13.1-1 | — |
| Debian 12 | pypy3 | 7.3.11+dfsg-2+deb12u3 | — |
| Debian 12 | python3.11 | 3.11.2-6+deb12u5 | — |
| Debian 11 | pypy3 | 7.3.5+dfsg-2+deb11u4 | DLA-3966-1 |
| Debian 11 | python3.9 | 3.9.2-1+deb11u2 | DLA-3980-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | python3.12 | 3.12.3-1ubuntu0.3 | USN-7116-1 |
| Ubuntu 22.04 LTS | python3.10 | 3.10.12-1~22.04.7 | USN-7116-1 |
| Ubuntu 20.04 LTS | python3.8 | 3.8.10-0ubuntu1~20.04.16 | USN-7348-1, USN-7116-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | python2.7 | 2.7.18-13ubuntu1.5+esm5 | USN-7488-1 |
| Ubuntu Pro 22.04 LTS | python3.11 | 3.11.0~rc1-1~22.04.1~esm2 | USN-7488-1 |
| Ubuntu Pro 20.04 LTS | python2.7 | 2.7.18-1~20.04.7+esm6 | USN-7488-1 |
| Ubuntu Pro 20.04 LTS | python3.9 | 3.9.5-3ubuntu0~20.04.1+esm3 | USN-7488-1 |
| Ubuntu Pro 18.04 LTS | python2.7 | 2.7.17-1~18.04ubuntu1.13+esm10 | USN-7488-1 |
| Ubuntu Pro 18.04 LTS | python3.6 | 3.6.9-1~18.04ubuntu1.13+esm3 | USN-7488-1 |
| Ubuntu Pro 18.04 LTS | python3.7 | 3.7.5-2ubuntu1~18.04.2+esm4 | USN-7488-1 |
| Ubuntu Pro 18.04 LTS | python3.8 | 3.8.0-3ubuntu1~18.04.2+esm3 | USN-7488-1 |
| Ubuntu Pro 16.04 LTS | python2.7 | 2.7.12-1ubuntu0~16.04.18+esm15 | USN-7488-1 |
| Ubuntu Pro 16.04 LTS | python3.5 | 3.5.2-2ubuntu0~16.04.13+esm16 | USN-7348-1 |
| Ubuntu Pro 14.04 LTS | python2.7 | 2.7.6-8ubuntu0.6+esm24 | USN-7488-1 |
| Ubuntu Pro 14.04 LTS | python3.4 | 3.4.3-1ubuntu1~14.04.7+esm14 | USN-7488-1 |
| Ubuntu Pro 14.04 LTS | python3.5 | 3.5.2-2ubuntu0~16.04.4~14.04.1+esm4 | USN-7348-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | python3 +8 | 3.12.9-1.el10 | RHBA-2025:6294 |
| RHEL 9 | python3 +8 | 3.9.21-1.el9_5 | RHSA-2024:10983 |
| RHEL 9 | python3.11 +6 | 3.11.9-7.el9_5.2 | RHSA-2024:11111 |
| RHEL 9 | python3.12 +6 | 3.12.5-2.el9_5.2 | RHSA-2024:10978 |
| RHEL 8 | Cython +1 | 0.29.21-5.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | PyYAML +1 | 5.4.1-1.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | mod_wsgi +1 | 4.7.1-7.module+el8.10.0+23075+0aa18782.1 | RHSA-2025:23530 |
| RHEL 8 | numpy +3 | 1.19.4-3.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | pybind11 +2 | 2.7.1-1.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | pytest +1 | 6.0.2-2.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-PyMySQL +1 | 0.10.1-2.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-attrs +1 | 20.3.0-2.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-cffi +1 | 1.14.3-2.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-chardet +1 | 3.0.4-19.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-cryptography +1 | 3.3.1-3.module+el8.10.0+21271+eccd1d86 | RHSA-2025:23530 |
| RHEL 8 | python-idna +1 | 2.10-4.module+el8.10.0+21815+bb024982 | RHSA-2025:23530 |
| RHEL 8 | python-iniconfig +1 | 1.1.1-2.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-lxml +1 | 4.6.5-1.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-more-itertools +1 | 8.5.0-2.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-packaging +1 | 20.4-4.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-pluggy +1 | 0.13.1-3.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-ply +1 | 3.11-10.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-psutil +1 | 5.8.0-4.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-psycopg2 +3 | 2.8.6-3.module+el8.10.0+21142+453d2b75 | RHSA-2025:23530 |
| RHEL 8 | python-py +1 | 1.10.0-1.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-pycparser +1 | 2.20-3.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-pysocks +1 | 1.7.1-4.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-requests +1 | 2.25.0-3.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-toml +1 | 0.10.1-5.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-urllib3 +1 | 1.25.10-5.module+el8.10.0+20443+f0a692fe | RHSA-2025:23530 |
| RHEL 8 | python-wcwidth +1 | 0.2.5-3.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-wheel +2 | 1:0.35.1-4.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python3 +7 | 3.6.8-69.el8_10 | RHSA-2024:10779 |
| RHEL 8 | python3.11 +7 | 3.11.11-1.el8_10 | RHSA-2024:10979 |
| RHEL 8 | python3.12 +7 | 3.12.8-1.el8_10 | RHSA-2024:10980 |
| RHEL 8 | python39 +7 | 3.9.25-2.module+el8.10.0+23718+1842ae33 | RHSA-2025:23530 |
| RHEL 8 | python39-pip +2 | 20.2.4-9.module+el8.10.0+21329+8d76b841 | RHSA-2025:23530 |
| RHEL 8 | python39-pyparsing +1 | 2.4.7-5.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python39-setuptools +2 | 50.3.2-7.module+el8.10.0+23406+03055bfb | RHSA-2025:23530 |
| RHEL 8 | python39-six +1 | 1.15.0-3.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | scipy +1 | 1.5.4-5.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | python3 +8 | 3.9.18-3.el9_4.7 | RHSA-2024:11024 |
| RHEL 9.4 EUS | python3.11 +6 | 3.11.7-1.el9_4.7 | RHSA-2025:0280 |
| RHEL 9.4 EUS | python3.12 +6 | 3.12.1-4.el9_4.5 | RHSA-2024:11035 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | python3 +7 | 3.9.21-1.el9_5 | ALSA-2024:10983 |
| AlmaLinux 9 | python3.11 +6 | 3.11.9-7.el9_5.2 | ALSA-2024:11111 |
| AlmaLinux 9 | python3.12 +6 | 3.12.5-2.el9_5.2 | ALSA-2024:10978 |
| AlmaLinux 8 | python3-idle +6 | 3.6.8-69.el8_10.alma.1 | ALSA-2024:10779 |
| AlmaLinux 8 | python3.11 +7 | 3.11.11-1.el8_10 | ALSA-2024:10979 |
| AlmaLinux 8 | python3.12 +7 | 3.12.8-1.el8_10 | ALSA-2024:10980 |
| AlmaLinux 8 | python39 +7 | 3.9.25-2.module_el8.10.0+4083+53cad1fb | ALSA-2025:23530 |
| AlmaLinux 8 | python39-Cython | 0.29.21-5.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-PyMySQL | 0.10.1-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-attrs | 20.3.0-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-cffi | 1.14.3-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-chardet | 3.0.4-19.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-cryptography | 3.3.1-3.module_el8.10.0+3765+2f9a457d | ALSA-2025:23530 |
| AlmaLinux 8 | python39-idna | 2.10-4.module_el8.10.0+3849+a48d89aa | ALSA-2025:23530 |
| AlmaLinux 8 | python39-iniconfig | 1.1.1-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-lxml | 4.6.5-1.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-mod_wsgi | 4.7.1-7.module_el8.10.0+3989+a618fe15.1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-more-itertools | 8.5.0-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-numpy +2 | 1.19.4-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-packaging | 20.4-4.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-pip +1 | 20.2.4-9.module_el8.10.0+3765+2f9a457d | ALSA-2025:23530 |
| AlmaLinux 8 | python39-pluggy | 0.13.1-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-ply | 3.11-10.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-psutil | 5.8.0-4.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-psycopg2 +2 | 2.8.6-3.module_el8.10.0+3765+2f9a457d | ALSA-2025:23530 |
| AlmaLinux 8 | python39-py | 1.10.0-1.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-pybind11 +1 | 2.7.1-1.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-pycparser | 2.20-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-pyparsing | 2.4.7-5.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-pysocks | 1.7.1-4.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-pytest | 6.0.2-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-pyyaml | 5.4.1-1.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-requests | 2.25.0-3.module_el8.9.0+3634+fb2a896c | ALSA-2025:23530 |
| AlmaLinux 8 | python39-scipy | 1.5.4-5.module_el8.9.0+3634+fb2a896c | ALSA-2025:23530 |
| AlmaLinux 8 | python39-setuptools +1 | 50.3.2-7.module_el8.10.0+4040+9207bbc0 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-six | 1.15.0-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-toml | 0.10.1-5.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-urllib3 | 1.25.10-5.module_el8.10.0+3765+2f9a457d | ALSA-2025:23530 |
| AlmaLinux 8 | python39-wcwidth | 0.2.5-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-wheel +1 | 1:0.35.1-4.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | python3.11 | 3.11.9-7.el9_5.2 | RLSA-2024:11111 |
| Rocky Linux 9 | python3.9 | 3.9.21-1.el9_5 | RLSA-2024:10983 |
| Rocky Linux 8 | Cython | 0.29.21-5.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | PyYAML | 5.4.1-1.module+el8.9.0+1418+f0d66789 | RLSA-2025:23530 |
| Rocky Linux 8 | mod_wsgi | 4.7.1-7.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | numpy | 1.19.4-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | pybind11 | 2.7.1-1.module+el8.9.0+1357+a3b80af7 | RLSA-2025:23530 |
| Rocky Linux 8 | pytest | 6.0.2-2.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-PyMySQL | 0.10.1-2.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-attrs | 20.3.0-2.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-cffi | 1.14.3-2.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-chardet | 3.0.4-19.module+el8.9.0+1418+f0d66789 | RLSA-2025:23530 |
| Rocky Linux 8 | python-cryptography | 3.3.1-3.module+el8.10.0+1697+7e517775 | RLSA-2025:23530 |
| Rocky Linux 8 | python-idna | 2.10-4.module+el8.10.0+1809+41195054 | RLSA-2025:23530 |
| Rocky Linux 8 | python-iniconfig | 1.1.1-2.module+el8.9.0+1332+dd574197 | RLSA-2025:23530 |
| Rocky Linux 8 | python-lxml | 4.6.5-1.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-more-itertools | 8.5.0-2.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-packaging | 20.4-4.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-pluggy | 0.13.1-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-ply | 3.11-10.module+el8.9.0+1418+f0d66789 | RLSA-2025:23530 |
| Rocky Linux 8 | python-psutil | 5.8.0-4.module+el8.9.0+1357+a3b80af7 | RLSA-2025:23530 |
| Rocky Linux 8 | python-psycopg2 | 2.8.6-3.module+el8.10.0+1660+b5b6f004 | RLSA-2025:23530 |
| Rocky Linux 8 | python-py | 1.10.0-1.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-pycparser | 2.20-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-pysocks | 1.7.1-4.module+el8.9.0+1418+f0d66789 | RLSA-2025:23530 |
| Rocky Linux 8 | python-requests | 2.25.0-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-toml | 0.10.1-5.module+el8.9.0+1332+dd574197 | RLSA-2025:23530 |
| Rocky Linux 8 | python-urllib3 | 1.25.10-5.module+el8.10.0+1545+03246da9 | RLSA-2025:23530 |
| Rocky Linux 8 | python-wcwidth | 0.2.5-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-wheel | 1:0.35.1-4.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python3 | 3.6.8-69.el8_10.rocky.0 | RLSA-2024:10779 |
| Rocky Linux 8 | python3.11 | 3.11.11-1.el8_10 | RLSA-2024:10979 |
| Rocky Linux 8 | python3.12 | 3.12.8-1.el8_10 | RLSA-2024:10980 |
| Rocky Linux 8 | python3x-pip | 20.2.4-9.module+el8.10.0+1721+e52d6351 | RLSA-2025:23530 |
| Rocky Linux 8 | python3x-pyparsing | 2.4.7-5.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python3x-setuptools | 50.3.2-7.module+el8.10.0+2057+30213a2b | RLSA-2025:23530 |
| Rocky Linux 8 | python3x-six | 1.15.0-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | scipy | 1.5.4-5.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | python3 +1 | 3.6.15-150300.10.75.1 | SUSE-SU-2024:3879-1 |
| SLES 15 SP6 | python311-core | 3.11.10-150600.3.9.2 | SUSE-SU-2024:3958-1 |
| SLES 15 SP5 | python3 +1 | 3.6.15-150300.10.75.1 | SUSE-SU-2024:3879-1 |
| SLES 15 SP5 | python39 | 3.9.20-150300.4.55.1 | SUSE-SU-2024:3945-1 |
| SLES 15 SP5 | python39-core | 3.9.20-150300.4.55.2 | SUSE-SU-2024:3945-1 |
| SLES 15 SP4 | python311 +1 | 3.11.10-150400.9.38.2 | SUSE-SU-2024:3957-1 |
| SLES 12 SP5 | python3 +1 | 3.4.10-25.142.1 | SUSE-SU-2024:3944-1 |
| SLES 12 SP5 | python36 +1 | 3.6.15-70.1 | SUSE-SU-2024:3929-1 |
| SLES 3 | python311 +1 | 3.11.10-150400.9.38.2 | SUSE-SU-2024:3958-1, SUSE-SU-2024:3957-1 |
| SLES 3 | python311-documentation | 3.11.10-150400.9.38.1 | SUSE-SU-2024:3957-1 |
| SLES 3 | python312 +1 | 3.12.7-150600.3.9.1 | SUSE-SU-2025:0048-1, SUSE-SU-2024:3959-1 |
| SLES 3 | python313 +1 | 3.13.5-150700.4.11.1 | SUSE-SU-2025:02074-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.1 | python311 +1 | 3.11.12-slfo.1.1_1.1 | SUSE-SU-2025:20374-1 |
| SLE Micro 6.0 | python311 +1 | 3.11.11-1.1 | SUSE-SU-2025:20154-1 |
| SLE Micro 5.5 | python3 +1 | 3.6.15-150300.10.75.1 | SUSE-SU-2024:3879-1 |
| SLE Micro 5.4 | python3 +1 | 3.6.15-150300.10.75.1 | SUSE-SU-2024:3879-1 |
| SLE Micro 5.3 | python3 +1 | 3.6.15-150300.10.75.1 | SUSE-SU-2024:3879-1 |
| SLE Micro 5.2 | python3 +1 | 3.6.15-150300.10.75.1 | SUSE-SU-2024:3879-1 |
| SLE Micro 5.1 | python3 +1 | 3.6.15-150000.3.164.1 | SUSE-SU-2024:3760-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-virtualenv | 20.26.6-1.1 | openSUSE-SU-2026:11974-1, openSUSE-SU-2024:14426-1 |
| openSUSE Tumbleweed | python310 | 3.10.15-2.1 | openSUSE-SU-2024:14427-1 |
| openSUSE Tumbleweed | python311 | 3.11.10-3.1 | openSUSE-SU-2024:14455-1 |
| openSUSE Tumbleweed | python312 | 3.12.7-2.1 | openSUSE-SU-2024:14456-1 |
| openSUSE Tumbleweed | python313 | 3.13.0-3.1 | openSUSE-SU-2024:14430-1 |
| openSUSE Tumbleweed | python39 | 3.9.20-4.1 | openSUSE-SU-2024:14428-1 |
| openSUSE Leap 15.6 | python3 +2 | 3.6.15-150300.10.75.1 | SUSE-SU-2024:3879-1 |
| openSUSE Leap 15.6 | python310 +2 | 3.10.15-150400.4.60.1 | SUSE-SU-2025:0049-1, SUSE-SU-2024:3924-1 |
| openSUSE Leap 15.6 | python311 +1 | 3.11.10-150600.3.9.2 | SUSE-SU-2024:3958-1 |
| openSUSE Leap 15.6 | python311-documentation | 3.11.10-150600.3.9.3 | SUSE-SU-2024:3958-1 |
| openSUSE Leap 15.6 | python312 +2 | 3.12.7-150600.3.9.1 | SUSE-SU-2025:0048-1, SUSE-SU-2024:3959-1 |
| openSUSE Leap 15.6 | python39 +1 | 3.9.20-150300.4.55.1 | SUSE-SU-2025:0047-1, SUSE-SU-2024:3945-1 |
| openSUSE Leap 15.6 | python39-core | 3.9.20-150300.4.55.2 | SUSE-SU-2025:0047-1, SUSE-SU-2024:3945-1 |
| openSUSE Leap 15.5 | python3 +2 | 3.6.15-150300.10.75.1 | SUSE-SU-2024:3879-1 |
| openSUSE Leap 15.5 | python310 +2 | 3.10.15-150400.4.60.1 | SUSE-SU-2024:3924-1 |
| openSUSE Leap 15.5 | python311 +1 | 3.11.10-150400.9.38.2 | SUSE-SU-2024:3957-1 |
| openSUSE Leap 15.5 | python311-documentation | 3.11.10-150400.9.38.1 | SUSE-SU-2024:3957-1 |
| openSUSE Leap 15.5 | python39 +1 | 3.9.20-150300.4.55.1 | SUSE-SU-2024:3945-1 |
| openSUSE Leap 15.5 | python39-core | 3.9.20-150300.4.55.2 | SUSE-SU-2024:3945-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.5 | python3 +1 | 3.6.15-150300.10.75.1 | SUSE-SU-2024:3879-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | python3 | 3.12.8-r0 | — |
| Alpine v3.23 | python3 | 3.12.8-r0 | — |
| Alpine v3.22 | python3 | 3.12.8-r0 | — |
| Alpine v3.21 | python3 | 3.12.8-r0 | — |
| Alpine v3.20 | python3 | 3.12.8-r0 | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | python3 | 3.11.11-r0 | — |
| Alpine v3.18 | python3 | 3.11.11-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3 +7 | 3.9.21-1.amzn2023.0.1 | ALAS2023-2025-900 |
| Amazon Linux 2023 | python3.11 +6 | 3.11.11-5.amzn2023.0.1 | ALAS2023-2025-871 |
| Amazon Linux 2023 | python3.12 +6 | 3.12.8-1.amzn2023.0.1 | ALAS2023-2025-808 |
| Amazon Linux 2 | python3 +6 | 3.7.16-1.amzn2.0.17 | ALAS2-2025-2817 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-py | No fix yet | — |
| Azure Linux 3 | python3 | 3.12.9-1 | — |
| Azure Linux 2 (CBL-Mariner) | python3 | 3.9.19-11 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | python3 +7 | 3.9.21-1.el9_5 | ELSA-2024-10983 |
| Oracle Linux 9 | python3.11 +6 | 3.11.9-7.el9_5.2 | ELSA-2024-11111 |
| Oracle Linux 9 | python3.12 +6 | 3.12.5-2.el9_5.2 | ELSA-2024-10978 |
| Oracle Linux 8 | python3-idle +6 | 3.6.8-69.0.1.el8_10 | ELSA-2024-10779 |
| Oracle Linux 8 | python3.11 +7 | 3.11.11-1.0.1.el8_10 | ELSA-2024-10979 |
| Oracle Linux 8 | python3.12 +7 | 3.12.8-1.el8_10 | ELSA-2024-10980 |
| Oracle Linux 8 | python39 +7 | 3.9.25-2.module+el8.10.0+90733+27f37730 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-Cython | 0.29.21-5.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-PyMySQL | 0.10.1-2.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-attrs | 20.3.0-2.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-cffi | 1.14.3-2.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-chardet | 3.0.4-19.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-cryptography | 3.3.1-3.0.1.module+el8.10.0+90269+2fa22b99 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-idna | 2.10-4.module+el8.10.0+90341+71ca88f4 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-iniconfig | 1.1.1-2.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-lxml | 4.6.5-1.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-mod_wsgi | 4.7.1-7.module+el8.10.0+90647+49247197.1 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-more-itertools | 8.5.0-2.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-numpy +2 | 1.19.4-3.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-packaging | 20.4-4.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-pip +1 | 20.2.4-9.module+el8.10.0+90269+2fa22b99 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-pluggy | 0.13.1-3.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-ply | 3.11-10.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-psutil | 5.8.0-4.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-psycopg2 +2 | 2.8.6-3.module+el8.10.0+90269+2fa22b99 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-py | 1.10.0-1.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-pybind11 +1 | 2.7.1-1.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-pycparser | 2.20-3.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-pyparsing | 2.4.7-5.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-pysocks | 1.7.1-4.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-pytest | 6.0.2-2.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-pyyaml | 5.4.1-1.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-requests | 2.25.0-3.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-scipy | 1.5.4-5.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-setuptools +1 | 50.3.2-7.module+el8.10.0+90647+49247197 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-six | 1.15.0-3.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-toml | 0.10.1-5.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-urllib3 | 1.25.10-5.module+el8.10.0+90269+2fa22b99 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-wcwidth | 0.2.5-3.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-wheel +1 | 1:0.35.1-4.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | python-3.10 | 3.10.15-r3 | — |
| Wolfi rolling | python-3.11 | 3.11.10-r4 | — |
| Wolfi rolling | python-3.12 | 3.12.7-r1 | — |
| Wolfi rolling | python-3.13 | 3.13.0-r1 | — |
Advisories 50
- ALSA-2024:11111 Moderate: python3.11 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:10978 Important: python3.12 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:10983 Moderate: python3.9:3.9.21 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:23530 Important: python39:3.9 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:10779 Moderate: python3:3.6.8 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:10979 Moderate: python3.11 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:10980 Important: python3.12 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:23530 Red Hat Security Advisory: python39:3.9 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- WID-SEC-2024-3270 Python: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Oct 11, 2026
- openSUSE-SU-2026:11974-1 python313-virtualenv-21.14.2-1.1 on GA media SUSE / openSUSE Security Updates · Oct 3, 2026
- RHBA-2025:6294 Red Hat Bug Fix Advisory: python3.12 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2025:0280 Red Hat Security Advisory: python3.11 security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2024:11111 Red Hat Security Advisory: python3.11 security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2024:11035 Red Hat Security Advisory: python3.12 security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2024:11024 Red Hat Security Advisory: python3.9:3.9.18 security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2024:10980 Red Hat Security Advisory: python3.12 security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2024:10983 Red Hat Security Advisory: python3.9:3.9.21 security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2024:10978 Red Hat Security Advisory: python3.12 security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2024:10979 Red Hat Security Advisory: python3.11 security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2024:10779 Red Hat Security Advisory: python3:3.6.8 security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- WID-SEC-2025-1559 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- USN-7488-1 python vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-7348-1 python3.5, python3.8 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-7116-1 python3.10, python3.12, python3.8 vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- SUSE-SU-2025:20154-1 Security update for python311 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20374-1 Security update for python311 SUSE / openSUSE Security Updates · Mar 23, 2026
- DLA-3980-1 python3.9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3966-1 pypy3 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2024:10980 Important: python3.12 security update Rocky Linux Security Advisories · Feb 5, 2026
- RLSA-2024:10979 Moderate: python3.11 security update Rocky Linux Security Advisories · Feb 5, 2026
- RLSA-2024:10983 Moderate: python3.9:3.9.21 security update Rocky Linux Security Advisories · Feb 5, 2026
- RLSA-2024:10779 Moderate: python3:3.6.8 security update Rocky Linux Security Advisories · Feb 4, 2026
- RLSA-2024:11111 Moderate: python3.11 security update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2024:3924-1 Security update for python310 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14428-1 python39-3.9.20-4.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0048-1 Security update for python312 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14427-1 python310-3.10.15-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3929-1 Security update for python36 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14426-1 python310-virtualenv-20.26.6-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3944-1 Security update for python3 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14456-1 python312-3.12.7-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3957-1 Security update for python311 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3879-1 Security update for python3 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:02074-1 Security update for python313 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3945-1 Security update for python39 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0047-1 Security update for python39 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14455-1 python311-3.11.10-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0049-1 Security update for python310 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3760-1 Security update for python3 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14430-1 python313-3.13.0-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://github.com/python/cpython/issues/124651 issue-tracking
- https://github.com/python/cpython/pull/124712 patch
- https://mail.python.org/archives/list/security-announce@python.org/thread/RSPJ2B5JL22FG3TKUJ7D7DQ4N5JRRBZL/ vendor-advisory
- https://github.com/python/cpython/commit/e52095a0c1005a87eed2276af7a1f2f66e2b6483 patch
- https://github.com/python/cpython/commit/633555735a023d3e4d92ba31da35b1205f9ecbd7 patch
- https://github.com/python/cpython/commit/8450b2482586857d689b6658f08de9c8179af7db patch
- https://github.com/python/cpython/commit/9286ab3a107ea41bd3f3c3682ce2512692bdded8 patch
- https://github.com/python/cpython/commit/ae961ae94bf19c8f8c7fbea3d1c25cc55ce8ae97 patch
- https://github.com/python/cpython/commit/d48cc82ed25e26b02eb97c6263d95dcaa1e9111b patch