Fluid Attacks Database

Description

virtualenv allows command injection through activation scripts for a virtual environment virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
pypi	virtualenv	>=0 <20.26.6	20.26.6
debian 12	python-virtualenv	=20.17.1+ds-1 \|\| =20.19.0+ds-1 \|\| =20.21.0+ds-1 \|\| =20.23.0+ds-1 \|\| =20.23.0+ds-2 \|\| =20.24.1+ds-1 \|\| =20.24.6+ds-1 \|\| =20.24.6+ds-2 \|\| =20.25.0+ds-1 \|\| =20.25.0+ds-2 \|\| =20.25.1+ds-1 \|\| =20.26.1+ds-1 \|\| =20.26.2+ds-1 \|\| =20.26.6+ds-1 \|\| =20.27.0+ds-1 \|\| =20.28.0+ds-1 \|\| =20.29.1+ds-1 \|\| =20.29.3+ds-1 \|\| =20.30.0+ds-1 \|\| =20.30.0+ds-2 \|\| =20.30.0+ds-3 \|\| =20.31.2+ds-1 \|\| =20.33.1+ds-1 \|\| =20.34.0+ds-1 \|\| =20.35.3+ds-1 \|\| =20.35.4+ds-1 \|\| =20.36.1+ds-1 \|\| =20.38.0+ds-1 \|\| =21.2.0+ds-1 \|\| =21.2.4+ds-1 \|\| =21.3.1+ds-1 \|\| =21.4.1+ds-1 \|\| =21.5.1+ds-1	-
debian 13	python-virtualenv	>=0 <20.26.6+ds-1	20.26.6+ds-1
debian 14	python-virtualenv	>=0 <20.26.6+ds-1	20.26.6+ds-1
rpm rhel7	python-virtualenv	-	-
rpm rhel8	python36	<0:3.6.8-39.module+el8.10.0+20784+edafcd43	0:3.6.8-39.module+el8.10.0+20784+edafcd43
rpm rhel8.8	python36	<0:3.6.8-38.module+el8.5.0+12207+5c5719bc	0:3.6.8-38.module+el8.5.0+12207+5c5719bc

Aliases

1. CVE-2024-538992. NVD-2024-538993. OSV-2024-538994. OSV-DEBIAN-2024-538995. GCVE-2024-538996. SECURITY-TRACKER-CVE-2024-53899

References

1. https://github.com/pypa/virtualenv/issues/27682. https://github.com/pypa/virtualenv/pull/27713. https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2024-187.yaml4. https://github.com/pypa/virtualenv/releases/tag/20.26.6

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.