CVE-2024-9287
Publication date 22 October 2024
Last updated 19 November 2024
Ubuntu priority
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.
Status
Package | Ubuntu Release | Status |
---|---|---|
python2.7 | 24.10 oracular | Not in release |
24.04 LTS noble | Not in release | |
22.04 LTS jammy |
Not affected
|
|
20.04 LTS focal |
Not affected
|
|
18.04 LTS bionic |
Not affected
|
|
16.04 LTS xenial |
Not affected
|
|
14.04 LTS trusty |
Not affected
|
|
python3.10 | 24.10 oracular | Not in release |
24.04 LTS noble | Not in release | |
22.04 LTS jammy |
Fixed 3.10.12-1~22.04.7
|
|
20.04 LTS focal | Not in release | |
python3.11 | 24.10 oracular | Not in release |
24.04 LTS noble | Not in release | |
22.04 LTS jammy |
Needs evaluation
|
|
20.04 LTS focal | Not in release | |
python3.12 | 24.10 oracular |
Fixed 3.12.7-1ubuntu1
|
24.04 LTS noble |
Fixed 3.12.3-1ubuntu0.3
|
|
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
python3.13 | 24.10 oracular |
Vulnerable
|
24.04 LTS noble | Not in release | |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
python3.4 | 24.10 oracular | Not in release |
24.04 LTS noble | Not in release | |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
14.04 LTS trusty | Ignored end of ESM support, was needs-triage | |
python3.5 | 24.10 oracular | Not in release |
24.04 LTS noble | Not in release | |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
16.04 LTS xenial |
Needs evaluation
|
|
14.04 LTS trusty | Ignored end of ESM support, was needs-triage | |
python3.6 | 24.10 oracular | Not in release |
24.04 LTS noble | Not in release | |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
18.04 LTS bionic |
Needs evaluation
|
|
python3.7 | 24.10 oracular | Not in release |
24.04 LTS noble | Not in release | |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
18.04 LTS bionic |
Needs evaluation
|
|
python3.8 | 24.10 oracular | Not in release |
24.04 LTS noble | Not in release | |
22.04 LTS jammy | Not in release | |
20.04 LTS focal |
Fixed 3.8.10-0ubuntu1~20.04.13
|
|
18.04 LTS bionic |
Needs evaluation
|
|
python3.9 | 24.10 oracular | Not in release |
24.04 LTS noble | Not in release | |
22.04 LTS jammy | Not in release | |
20.04 LTS focal |
Needs evaluation
|
Patch details
Package | Patch details |
---|---|
python3.10 |
|
python3.11 |
|
python3.12 |
|
python3.13 |
|
python3.9 |
|
References
Related Ubuntu Security Notices (USN)
- USN-7116-1
- Python vulnerability
- 19 November 2024