github - ghsa-grqq-hcc7-crmr

ghsa-grqq-hcc7-crmr

Vulnerability from github

Published

2024-10-22 18:32

Modified

2025-04-26 00:30

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.3 (Medium) - CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Green

Details

A vulnerability has been found in the CPython venv module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.

Show details on source website

JSON

To clipboard

{
   affected: [],
   aliases: [
      "CVE-2024-9287",
   ],
   database_specific: {
      cwe_ids: [
         "CWE-428",
         "CWE-77",
      ],
      github_reviewed: false,
      github_reviewed_at: null,
      nvd_published_at: "2024-10-22T17:15:06Z",
      severity: "MODERATE",
   },
   details: "A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment \"activation\" scripts (ie \"source venv/bin/activate\"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie \"./venv/bin/python\") are not affected.",
   id: "GHSA-grqq-hcc7-crmr",
   modified: "2025-04-26T00:30:23Z",
   published: "2024-10-22T18:32:12Z",
   references: [
      {
         type: "ADVISORY",
         url: "https://nvd.nist.gov/vuln/detail/CVE-2024-9287",
      },
      {
         type: "WEB",
         url: "https://github.com/python/cpython/issues/124651",
      },
      {
         type: "WEB",
         url: "https://github.com/python/cpython/pull/124712",
      },
      {
         type: "WEB",
         url: "https://github.com/python/cpython/commit/633555735a023d3e4d92ba31da35b1205f9ecbd7",
      },
      {
         type: "WEB",
         url: "https://github.com/python/cpython/commit/8450b2482586857d689b6658f08de9c8179af7db",
      },
      {
         type: "WEB",
         url: "https://github.com/python/cpython/commit/9286ab3a107ea41bd3f3c3682ce2512692bdded8",
      },
      {
         type: "WEB",
         url: "https://github.com/python/cpython/commit/ae961ae94bf19c8f8c7fbea3d1c25cc55ce8ae97",
      },
      {
         type: "WEB",
         url: "https://github.com/python/cpython/commit/d48cc82ed25e26b02eb97c6263d95dcaa1e9111b",
      },
      {
         type: "WEB",
         url: "https://github.com/python/cpython/commit/e52095a0c1005a87eed2276af7a1f2f66e2b6483",
      },
      {
         type: "WEB",
         url: "https://mail.python.org/archives/list/security-announce@python.org/thread/RSPJ2B5JL22FG3TKUJ7D7DQ4N5JRRBZL",
      },
      {
         type: "WEB",
         url: "https://security.netapp.com/advisory/ntap-20250425-0006",
      },
   ],
   schema_version: "1.4.0",
   severity: [
      {
         score: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
         type: "CVSS_V3",
      },
      {
         score: "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green",
         type: "CVSS_V4",
      },
   ],
}

CVE-2024-9287 (GCVE-0-2024-9287)

Vulnerability from cvelistv5

Published

2024-10-22 16:34

Modified

2025-04-25 23:02

Severity ?

5.3 (Medium) - CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Green

Summary

A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.

References

▼	URL	Tags
	https://github.com/python/cpython/issues/124651	issue-tracking
	https://github.com/python/cpython/pull/124712	patch
	https://mail.python.org/archives/list/security-announce@python.org/thread/RSPJ2B5JL22FG3TKUJ7D7DQ4N5JRRBZL/	vendor-advisory
	https://github.com/python/cpython/commit/e52095a0c1005a87eed2276af7a1f2f66e2b6483	patch
	https://github.com/python/cpython/commit/633555735a023d3e4d92ba31da35b1205f9ecbd7	patch
	https://github.com/python/cpython/commit/8450b2482586857d689b6658f08de9c8179af7db	patch
	https://github.com/python/cpython/commit/9286ab3a107ea41bd3f3c3682ce2512692bdded8	patch
	https://github.com/python/cpython/commit/ae961ae94bf19c8f8c7fbea3d1c25cc55ce8ae97	patch
	https://github.com/python/cpython/commit/d48cc82ed25e26b02eb97c6263d95dcaa1e9111b	patch

Impacted products

	Vendor	Product	Version
	Python Software Foundation	CPython	Version: 0 Version: 3.10.0 Version: 3.11.0 Version: 3.12.0 Version: 3.13.0 Version: 3.14.0a1

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:python:cpython:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "cpython",
                  vendor: "python",
                  versions: [
                     {
                        lessThanOrEqual: "3.13.0",
                        status: "affected",
                        version: "0",
                        versionType: "python",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-9287",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-10-22T17:11:46.736068Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-10-22T17:13:32.968Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2025-04-25T23:02:57.606Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  url: "https://security.netapp.com/advisory/ntap-20250425-0006/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               modules: [
                  "venv",
               ],
               product: "CPython",
               repo: "https://github.com/python/cpython",
               vendor: "Python Software Foundation",
               versions: [
                  {
                     lessThan: "3.9.21",
                     status: "affected",
                     version: "0",
                     versionType: "python",
                  },
                  {
                     lessThan: "3.10.16",
                     status: "affected",
                     version: "3.10.0",
                     versionType: "python",
                  },
                  {
                     lessThan: "3.11.11",
                     status: "affected",
                     version: "3.11.0",
                     versionType: "python",
                  },
                  {
                     lessThan: "3.12.8",
                     status: "affected",
                     version: "3.12.0",
                     versionType: "python",
                  },
                  {
                     lessThan: "3.13.1",
                     status: "affected",
                     version: "3.13.0",
                     versionType: "python",
                  },
                  {
                     lessThan: "3.14.0a2",
                     status: "affected",
                     version: "3.14.0a1",
                     versionType: "python",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment \"activation\" scripts (ie \"source venv/bin/activate\"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie \"./venv/bin/python\") are not affected.<br>",
                  },
               ],
               value: "A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment \"activation\" scripts (ie \"source venv/bin/activate\"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie \"./venv/bin/python\") are not affected.",
            },
         ],
         metrics: [
            {
               cvssV4_0: {
                  Automatable: "NOT_DEFINED",
                  Recovery: "NOT_DEFINED",
                  Safety: "NOT_DEFINED",
                  attackComplexity: "LOW",
                  attackRequirements: "PRESENT",
                  attackVector: "LOCAL",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  privilegesRequired: "HIGH",
                  providerUrgency: "GREEN",
                  subAvailabilityImpact: "NONE",
                  subConfidentialityImpact: "NONE",
                  subIntegrityImpact: "NONE",
                  userInteraction: "ACTIVE",
                  valueDensity: "NOT_DEFINED",
                  vectorString: "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Green",
                  version: "4.0",
                  vulnAvailabilityImpact: "NONE",
                  vulnConfidentialityImpact: "HIGH",
                  vulnIntegrityImpact: "HIGH",
                  vulnerabilityResponseEffort: "NOT_DEFINED",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-428",
                     description: "CWE-428 Unquoted Search Path or Element",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-01-31T19:55:27.648Z",
            orgId: "28c92f92-d60d-412d-b760-e73465c3df22",
            shortName: "PSF",
         },
         references: [
            {
               tags: [
                  "issue-tracking",
               ],
               url: "https://github.com/python/cpython/issues/124651",
            },
            {
               tags: [
                  "patch",
               ],
               url: "https://github.com/python/cpython/pull/124712",
            },
            {
               tags: [
                  "vendor-advisory",
               ],
               url: "https://mail.python.org/archives/list/security-announce@python.org/thread/RSPJ2B5JL22FG3TKUJ7D7DQ4N5JRRBZL/",
            },
            {
               tags: [
                  "patch",
               ],
               url: "https://github.com/python/cpython/commit/e52095a0c1005a87eed2276af7a1f2f66e2b6483",
            },
            {
               tags: [
                  "patch",
               ],
               url: "https://github.com/python/cpython/commit/633555735a023d3e4d92ba31da35b1205f9ecbd7",
            },
            {
               tags: [
                  "patch",
               ],
               url: "https://github.com/python/cpython/commit/8450b2482586857d689b6658f08de9c8179af7db",
            },
            {
               tags: [
                  "patch",
               ],
               url: "https://github.com/python/cpython/commit/9286ab3a107ea41bd3f3c3682ce2512692bdded8",
            },
            {
               tags: [
                  "patch",
               ],
               url: "https://github.com/python/cpython/commit/ae961ae94bf19c8f8c7fbea3d1c25cc55ce8ae97",
            },
            {
               tags: [
                  "patch",
               ],
               url: "https://github.com/python/cpython/commit/d48cc82ed25e26b02eb97c6263d95dcaa1e9111b",
            },
         ],
         source: {
            discovery: "UNKNOWN",
         },
         title: "Virtual environment (venv) activation scripts don't quote paths",
         x_generator: {
            engine: "Vulnogram 0.2.0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "28c92f92-d60d-412d-b760-e73465c3df22",
      assignerShortName: "PSF",
      cveId: "CVE-2024-9287",
      datePublished: "2024-10-22T16:34:39.210Z",
      dateReserved: "2024-09-27T14:48:44.181Z",
      dateUpdated: "2025-04-25T23:02:57.606Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted