Command Injection Vulnerability in Python3's venv Module
Summary
ALPINE-CVE-2024-9287: A vulnerability has been found in the CPython venv module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "... Affects python3 versions < 3.11.11-r0. Fixed in 3.11.11-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3 is a widely-used programming language known for its simplicity and versatility. The venv module is a standard library feature that allows users to create isolated Python environments, enabling them to manage dependencies for different projects without conflicts. However, a recent vulnerability has been identified in the venv module, which could potentially allow attackers to execute arbitrary commands during the activation of virtual environments.
Vulnerability Detail
A vulnerability has been discovered in the CPython venv module and CLI, where path names provided when creating a virtual environment are not properly quoted. This flaw allows an attacker to inject commands into the virtual environment's activation scripts. Consequently, when an attacker-controlled virtual environment is activated, it can execute malicious commands, posing a significant security risk. Virtual environments created by trusted users or those not activated before use remain unaffected.
How To Fix
Minimum fixed version
3.11.11-r0
This is the first release that contains the fix.
sudo apk add --upgrade python3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid activating virtual environments that may have been created by untrusted sources. Instead, use the Python interpreter directly from the virtual environment without activation, for example:
./venv/bin/python
Conclusion
In summary, a significant command injection vulnerability has been identified in the Python3 venv module, allowing attackers to execute arbitrary commands through improperly quoted path names. Users are advised to update their Python3 packages to the latest patched versions to mitigate this risk and to exercise caution when activating virtual environments.
See every vulnerability recorded for python3 →
FAQ
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without requiring any signup.
The affected versions include Python3 in Alpine Linux v3.18, v3.19, v3.20, v3.21, and v3.22.
If an immediate update is not possible, avoid using virtual environments created by untrusted sources and run Python directly from the virtual environment's bin directory.
While this report focuses on Alpine Linux, the underlying vulnerability exists in the CPython venv module, which may affect other distributions as well.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.
