Vulnerability · Published Nov 24, 2024 · Assigned by mitre
CVE-2024-53899
High 8.4
In plain English
A high-severity OS command injection in the python-nose-docs package (AlmaLinux). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.4High
Exploit odds (30 days)1.6%top 24.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | python-nose-docs | 1.3.7-31.module_el8.9.0+3700+efebe9fd | ALSA-2024:10953 |
| AlmaLinux:8 | python-pymongo-doc | 3.7.0-1.module_el8.9.0+3700+efebe9fd | ALSA-2024:10953 |
| AlmaLinux:8 | python-sqlalchemy-doc | 1.3.2-3.module_el8.10.0+3769+3838165b | ALSA-2024:10953 |
| AlmaLinux:8 | python-virtualenv-doc | 15.1.0-23.module_el8.10.0+3937+b6a3652f | ALSA-2024:10953 |
| AlmaLinux:8 | python3-PyMySQL | 0.10.1-2.module_el8.9.0+3700+efebe9fd | ALSA-2024:10953 |
| AlmaLinux:8 | python3-bson | 3.7.0-1.module_el8.9.0+3700+efebe9fd | ALSA-2024:10953 |
| AlmaLinux:8 | python3-distro | 1.4.0-2.module_el8.9.0+3700+efebe9fd | ALSA-2024:10953 |
| AlmaLinux:8 | python3-docs | 3.6.7-2.module_el8.9.0+3700+efebe9fd | ALSA-2024:10953 |
| AlmaLinux:8 | python3-docutils | 0.14-12.module_el8.9.0+3700+efebe9fd | ALSA-2024:10953 |
| AlmaLinux:8 | python3-nose | 1.3.7-31.module_el8.9.0+3700+efebe9fd | ALSA-2024:10953 |
| AlmaLinux:8 | python3-pygments | 2.2.0-22.module_el8.9.0+3700+efebe9fd | ALSA-2024:10953 |
| AlmaLinux:8 | python3-pymongo | 3.7.0-1.module_el8.9.0+3700+efebe9fd | ALSA-2024:10953 |
| AlmaLinux:8 | python3-pymongo-gridfs | 3.7.0-1.module_el8.9.0+3700+efebe9fd | ALSA-2024:10953 |
| AlmaLinux:8 | python3-scipy | 1.0.0-21.module_el8.9.0+3700+efebe9fd | ALSA-2024:10953 |
| AlmaLinux:8 | python3-sqlalchemy | 1.3.2-3.module_el8.10.0+3769+3838165b | ALSA-2024:10953 |
| AlmaLinux:8 | python3-virtualenv | 15.1.0-23.module_el8.10.0+3937+b6a3652f | ALSA-2024:10953 |
| AlmaLinux:8 | python3-wheel | 1:0.31.1-3.module_el8.9.0+3700+efebe9fd | ALSA-2024:10953 |
| AlmaLinux:8 | python3-wheel-wheel | 1:0.31.1-3.module_el8.9.0+3700+efebe9fd | ALSA-2024:10953 |
| AlmaLinux:8 | python36 | 3.6.8-39.module_el8.10.0+3769+3838165b | ALSA-2024:10953 |
| AlmaLinux:8 | python36-debug | 3.6.8-39.module_el8.10.0+3769+3838165b | ALSA-2024:10953 |
| AlmaLinux:8 | python36-devel | 3.6.8-39.module_el8.10.0+3769+3838165b | ALSA-2024:10953 |
| AlmaLinux:8 | python36-rpm-macros | 3.6.8-39.module_el8.10.0+3769+3838165b | ALSA-2024:10953 |
| Debian:12 | python-virtualenv | no fix listed | DEBIAN-CVE-2024-53899 |
| Debian:13 | python-virtualenv | 20.26.6+ds-1 | DEBIAN-CVE-2024-53899 |
| Debian:14 | python-virtualenv | 20.26.6+ds-1 | DEBIAN-CVE-2024-53899 |
| PyPI | virtualenv | 20.26.6 | PYSEC-2024-187 |
| PyPI | virtualenv | 20.26.6 | GHSA-rqc4-2hc7-8c8v |
| Rocky Linux:8 | python-PyMySQL | 0:0.10.1-2.module+el8.10.0+1582+bc278001 | RLSA-2024:10953 |
| Rocky Linux:8 | python-distro | 0:1.4.0-2.module+el8.10.0+1592+61442852 | RLSA-2024:10953 |
| Rocky Linux:8 | python-docs | 0:3.6.7-2.module+el8.10.0+1592+61442852 | RLSA-2024:10953 |
| Rocky Linux:8 | python-docutils | 0:0.14-12.module+el8.10.0+1592+61442852 | RLSA-2024:10953 |
| Rocky Linux:8 | python-nose | 0:1.3.7-31.module+el8.10.0+1592+61442852 | RLSA-2024:10953 |
| Rocky Linux:8 | python-pygments | 0:2.2.0-22.module+el8.10.0+1592+61442852 | RLSA-2024:10953 |
| Rocky Linux:8 | python-pymongo | 0:3.7.0-1.module+el8.10.0+1592+61442852 | RLSA-2024:10953 |
| Rocky Linux:8 | python-sqlalchemy | 0:1.3.2-3.module+el8.10.0+1602+b47e27fa | RLSA-2024:10953 |
| Rocky Linux:8 | python-virtualenv | 0:15.1.0-23.module+el8.10.0+1910+234ad790 | RLSA-2024:10953 |
| Rocky Linux:8 | python-wheel | 1:0.31.1-3.module+el8.10.0+1592+61442852 | RLSA-2024:10953 |
| Rocky Linux:8 | python36 | 0:3.6.8-39.module+el8.10.0+1592+61442852 | RLSA-2024:10953 |
| Rocky Linux:8 | scipy | 0:1.0.0-21.module+el8.10.0+1592+61442852 | RLSA-2024:10953 |
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H