Critical Vulnerability in Python 3.x Packages: Command Injection Risk in Virtual Environment Creation
Summary
UBUNTU-CVE-2024-9287: A vulnerability has been found in the CPython venv module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "... Affects python3.4 versions < 3.4.3-1ubuntu1~14.04.7+esm14. Fixed in 3.4.3-1ubuntu1~14.04.7+esm14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. The affected packages, including python3.4, python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, and python3.12, are essential for creating and managing virtual environments. These environments allow developers to isolate dependencies for different projects, ensuring that libraries do not conflict. However, a recent vulnerability has been identified in the venv module, which poses a significant risk to users creating virtual environments.
Vulnerability Detail
A vulnerability has been found in the CPython venv module and CLI where path names provided when creating a virtual environment were not quoted properly. This flaw allows an attacker to inject commands into virtual environment activation scripts, which can lead to unauthorized command execution when the virtual environment is activated. Virtual environments created by an attacker or activated before being used are particularly vulnerable, while those not activated remain unaffected. The CVSS score of this vulnerability is 7.8, indicating a high severity level.
How To Fix
Minimum fixed version
3.4.3-1ubuntu1~14.04.7+esm14
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python3.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid activating virtual environments created by untrusted sources. Instead, use the command './venv/bin/python' to run Python scripts without activating the environment.
Conclusion
The vulnerability in the Python venv module poses a significant risk to users creating virtual environments, allowing for potential command injection. It is crucial to update to the patched versions of the affected packages to mitigate this risk. Users should also be cautious when activating virtual environments from untrusted sources.
See every vulnerability recorded for python3.4 →
FAQ
The vulnerability allows command injection through improperly quoted path names when creating virtual environments.
The vulnerability affects Python versions 3.4, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10, 3.11, and 3.12.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
If you cannot update, avoid using virtual environments created by untrusted sources and consider using the workaround provided.
Related vulnerabilities
Recent vulnerabilities recorded for python3.4.
