Homepage

CVE-2024-9287 The advisory has been revoked - it doesn't affect any version of package python2.7  (opens in a new tab)

Threat Intelligence

EPSS
0.04% (15th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN11-PYTHON27-8305725
  • published26 Oct 2024
  • disclosed22 Oct 2024
Report a new vulnerability Found a mistake?

Introduced: 22 Oct 2024

CVE-2024-9287  (opens in a new tab)

Amendment

The Debian security team deemed this advisory irrelevant for Debian:11.

NVD Description

Note: Versions mentioned in the description apply only to the upstream python2.7 package and not the python2.7 package as distributed by Debian.

A vulnerability has been found in the CPython venv module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.