CVE-2024-9287

CVE Details

Release Date:

2024-10-22

Description

A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment 'activation' scripts (ie 'source venv/bin/activate'). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie './venv/bin/python') are not affected.

See more information about CVE-2024-9287 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	6.3
Vector String:	CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N
Version:	3.1
Attack Vector:	Local
Attack Complexity:	Low
Privileges Required:	High
User Interaction:	Required
Scope:	Changed
Confidentiality:	Low
Integrity:	High
Availability:	None

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (python3)	ELSA-2024-10779	2024-12-04
Oracle Linux version 8 (python3.11)	ELSA-2024-10979	2024-12-12
Oracle Linux version 8 (python3.12)	ELSA-2024-10980	2024-12-12
Oracle Linux version 9 (python3.11)	ELSA-2024-11111	2024-12-16
Oracle Linux version 9 (python3.12)	ELSA-2024-10978	2024-12-12
Oracle Linux version 9 (python3.9)	ELSA-2024-10983	2024-12-12