Command Injection Vulnerability in CPython venv Module - CVE-2024-9287
Summary
CVE-2024-9287: A vulnerability has been found in the CPython venv module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "... Affects python3 across 7 version ranges.
< 3.11.11-r0
< 8450b2482586857d689b6658f08de9c8179af7db
< 9286ab3a107ea41bd3f3c3682ce2512692bdded8
< 633555735a023d3e4d92ba31da35b1205f9ecbd7
< ae961ae94bf19c8f8c7fbea3d1c25cc55ce8ae97
< d48cc82ed25e26b02eb97c6263d95dcaa1e9111b
< e52095a0c1005a87eed2276af7a1f2f66e2b6483
Fixed in 3.11.11-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The CPython venv module is a standard library component that allows users to create isolated Python environments. This functionality is crucial for managing dependencies and avoiding conflicts between projects. The venv module enables users to create a self-contained directory tree that contains the Python executable and its associated libraries. However, a recent vulnerability has been identified that compromises the security of these virtual environments.
Vulnerability Detail
A vulnerability has been discovered in the CPython venv module and CLI, where path names provided during the creation of a virtual environment are not properly quoted. This oversight allows an attacker to inject arbitrary commands into the activation scripts of the virtual environment (e.g., 'source venv/bin/activate'). As a result, when a user activates an attacker-controlled virtual environment, malicious commands can be executed, potentially leading to unauthorized access or data manipulation. This vulnerability affects only virtual environments created by an attacker or those activated before use, leaving other environments unaffected.
How To Fix
Minimum fixed version
3.11.11-r0
This is the first release that contains the fix.
sudo apk add --upgrade python3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid activating virtual environments created by untrusted sources. Instead, use the Python interpreter directly from the virtual environment without activation by executing:
./venv/bin/python
This method bypasses the activation scripts and mitigates the risk of executing injected commands.
Conclusion
CVE-2024-9287 represents a significant security risk for users of the CPython venv module, allowing for potential command injection through improperly handled path names. It is crucial for users to update their Python packages to mitigate this vulnerability and to exercise caution when dealing with virtual environments from untrusted sources.
See every vulnerability recorded for python3 →
FAQ
CVE-2024-9287 is a vulnerability in the CPython venv module that allows command injection through improperly quoted path names during virtual environment creation.
Users who create or activate virtual environments using the CPython venv module are at risk, especially if the environments are created by untrusted sources.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If immediate updates are not possible, avoid activating virtual environments from untrusted sources and use the Python interpreter directly to mitigate risks.
The vulnerability affects specific versions of Python, particularly those included in Debian distributions, such as python2.7, python3.11, python3.12, python3.13, and python3.9.
Related vulnerabilities
Recent vulnerabilities recorded for python3.
