Description
virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink_app_data can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its owner no longer controls. This issue is fixed in version 21.14.10.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pypa | virtualenv | >= 21.14.8, < 21.14.10 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-virtualenv | No fix yet | — |
| Debian 13 | python-virtualenv | No fix yet | — |
| Debian 12 | python-virtualenv | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | python-virtualenv | No fix yet | — |
| Ubuntu 26.04 LTS | python-virtualenv | No fix yet | — |
| Ubuntu 18.04 LTS | python-virtualenv | No fix yet | — |
| Ubuntu 16.04 LTS | python-virtualenv | No fix yet | — |
| Ubuntu 14.04 LTS | python-virtualenv | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | python-virtualenv | No fix yet | — |
| Ubuntu Pro 22.04 LTS | python-virtualenv | No fix yet | — |
| Ubuntu Pro 20.04 LTS | python-virtualenv | No fix yet | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-virtualenv | 20.36.1-10 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | py3-cassandra-medusa | 0.31.0-r4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | virtualenv | >= 21.14.8, < 21.14.10 | 21.14.10 | GHSA-4f8h-vr72-p32c |