Vulnerability · Published Oct 22, 2024 · Assigned by PSF
CVE-2024-9287Virtual environment (venv) activation scripts don't quote paths
Medium 5.3
In plain English
A medium-severity security flaw in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)5.3Medium
Exploit odds (30 days)0.6%top 48.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | platform-python | 3.6.8-69.el8_10.alma.1 | ALSA-2024:10779 |
| AlmaLinux:8 | platform-python-debug | 3.6.8-69.el8_10.alma.1 | ALSA-2024:10779 |
| AlmaLinux:8 | platform-python-devel | 3.6.8-69.el8_10.alma.1 | ALSA-2024:10779 |
| AlmaLinux:9 | python-unversioned-command | 3.9.21-1.el9_5 | ALSA-2024:10983 |
| AlmaLinux:9 | python3 | 3.9.21-1.el9_5 | ALSA-2024:10983 |
| AlmaLinux:9 | python3-debug | 3.9.21-1.el9_5 | ALSA-2024:10983 |
| AlmaLinux:9 | python3-devel | 3.9.21-1.el9_5 | ALSA-2024:10983 |
| AlmaLinux:8 | python3-idle | 3.6.8-69.el8_10.alma.1 | ALSA-2024:10779 |
| AlmaLinux:9 | python3-idle | 3.9.21-1.el9_5 | ALSA-2024:10983 |
| AlmaLinux:8 | python3-libs | 3.6.8-69.el8_10.alma.1 | ALSA-2024:10779 |
| AlmaLinux:9 | python3-libs | 3.9.21-1.el9_5 | ALSA-2024:10983 |
| AlmaLinux:8 | python3-test | 3.6.8-69.el8_10.alma.1 | ALSA-2024:10779 |
| AlmaLinux:9 | python3-test | 3.9.21-1.el9_5 | ALSA-2024:10983 |
| AlmaLinux:8 | python3-tkinter | 3.6.8-69.el8_10.alma.1 | ALSA-2024:10779 |
| AlmaLinux:9 | python3-tkinter | 3.9.21-1.el9_5 | ALSA-2024:10983 |
| AlmaLinux:8 | python3.11 | 3.11.11-1.el8_10 | ALSA-2024:10979 |
| AlmaLinux:9 | python3.11 | 3.11.9-7.el9_5.2 | ALSA-2024:11111 |
| AlmaLinux:8 | python3.11-debug | 3.11.11-1.el8_10 | ALSA-2024:10979 |
| AlmaLinux:9 | python3.11-debug | 3.11.9-7.el9_5.2 | ALSA-2024:11111 |
| AlmaLinux:8 | python3.11-devel | 3.11.11-1.el8_10 | ALSA-2024:10979 |
| AlmaLinux:9 | python3.11-devel | 3.11.9-7.el9_5.2 | ALSA-2024:11111 |
| AlmaLinux:8 | python3.11-idle | 3.11.11-1.el8_10 | ALSA-2024:10979 |
| AlmaLinux:9 | python3.11-idle | 3.11.9-7.el9_5.2 | ALSA-2024:11111 |
| AlmaLinux:8 | python3.11-libs | 3.11.11-1.el8_10 | ALSA-2024:10979 |
| AlmaLinux:9 | python3.11-libs | 3.11.9-7.el9_5.2 | ALSA-2024:11111 |
| AlmaLinux:8 | python3.11-rpm-macros | 3.11.11-1.el8_10 | ALSA-2024:10979 |
| AlmaLinux:8 | python3.11-test | 3.11.11-1.el8_10 | ALSA-2024:10979 |
| AlmaLinux:9 | python3.11-test | 3.11.9-7.el9_5.2 | ALSA-2024:11111 |
| AlmaLinux:8 | python3.11-tkinter | 3.11.11-1.el8_10 | ALSA-2024:10979 |
| AlmaLinux:9 | python3.11-tkinter | 3.11.9-7.el9_5.2 | ALSA-2024:11111 |
| AlmaLinux:8 | python3.12 | 3.12.8-1.el8_10 | ALSA-2024:10980 |
| AlmaLinux:9 | python3.12 | 3.12.5-2.el9_5.2 | ALSA-2024:10978 |
| AlmaLinux:8 | python3.12-debug | 3.12.8-1.el8_10 | ALSA-2024:10980 |
| AlmaLinux:9 | python3.12-debug | 3.12.5-2.el9_5.2 | ALSA-2024:10978 |
| AlmaLinux:8 | python3.12-devel | 3.12.8-1.el8_10 | ALSA-2024:10980 |
| AlmaLinux:9 | python3.12-devel | 3.12.5-2.el9_5.2 | ALSA-2024:10978 |
| AlmaLinux:8 | python3.12-idle | 3.12.8-1.el8_10 | ALSA-2024:10980 |
| AlmaLinux:9 | python3.12-idle | 3.12.5-2.el9_5.2 | ALSA-2024:10978 |
| AlmaLinux:8 | python3.12-libs | 3.12.8-1.el8_10 | ALSA-2024:10980 |
| AlmaLinux:9 | python3.12-libs | 3.12.5-2.el9_5.2 | ALSA-2024:10978 |
| AlmaLinux:8 | python3.12-rpm-macros | 3.12.8-1.el8_10 | ALSA-2024:10980 |
| AlmaLinux:8 | python3.12-test | 3.12.8-1.el8_10 | ALSA-2024:10980 |
| AlmaLinux:9 | python3.12-test | 3.12.5-2.el9_5.2 | ALSA-2024:10978 |
| AlmaLinux:8 | python3.12-tkinter | 3.12.8-1.el8_10 | ALSA-2024:10980 |
| AlmaLinux:9 | python3.12-tkinter | 3.12.5-2.el9_5.2 | ALSA-2024:10978 |
| AlmaLinux:8 | python39 | 3.9.25-2.module_el8.10.0+4083+53cad1fb | ALSA-2025:23530 |
| AlmaLinux:8 | python39-Cython | 0.29.21-5.module_el8.6.0+3248+c431e88c | ALSA-2025:23530 |
| AlmaLinux:8 | python39-Cython | 0.29.21-5.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-PyMySQL | 0.10.1-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-attrs | 20.3.0-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-cffi | 1.14.3-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-cffi | 1.14.3-2.module_el8.6.0+3248+c431e88c | ALSA-2025:23530 |
| AlmaLinux:8 | python39-chardet | 3.0.4-19.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-cryptography | 3.3.1-3.module_el8.10.0+3765+2f9a457d | ALSA-2025:23530 |
| AlmaLinux:8 | python39-debug | 3.9.25-2.module_el8.10.0+4083+53cad1fb | ALSA-2025:23530 |
| AlmaLinux:8 | python39-devel | 3.9.25-2.module_el8.10.0+4083+53cad1fb | ALSA-2025:23530 |
| AlmaLinux:8 | python39-idle | 3.9.25-2.module_el8.10.0+4083+53cad1fb | ALSA-2025:23530 |
| AlmaLinux:8 | python39-idna | 2.10-4.module_el8.10.0+3849+a48d89aa | ALSA-2025:23530 |
| AlmaLinux:8 | python39-iniconfig | 1.1.1-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-libs | 3.9.25-2.module_el8.10.0+4083+53cad1fb | ALSA-2025:23530 |
| AlmaLinux:8 | python39-lxml | 4.6.5-1.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-lxml | 4.6.5-1.module_el8.6.0+3248+c431e88c | ALSA-2025:23530 |
| AlmaLinux:8 | python39-mod_wsgi | 4.7.1-7.module_el8.10.0+3989+a618fe15.1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-more-itertools | 8.5.0-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-numpy | 1.19.4-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-numpy | 1.19.4-3.module_el8.6.0+3248+c431e88c | ALSA-2025:23530 |
| AlmaLinux:8 | python39-numpy-doc | 1.19.4-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-numpy-f2py | 1.19.4-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-numpy-f2py | 1.19.4-3.module_el8.6.0+3248+c431e88c | ALSA-2025:23530 |
| AlmaLinux:8 | python39-packaging | 20.4-4.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-pip | 20.2.4-9.module_el8.10.0+3765+2f9a457d | ALSA-2025:23530 |
| AlmaLinux:8 | python39-pip-wheel | 20.2.4-9.module_el8.10.0+3765+2f9a457d | ALSA-2025:23530 |
| AlmaLinux:8 | python39-pluggy | 0.13.1-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-ply | 3.11-10.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-psutil | 5.8.0-4.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-psutil | 5.8.0-4.module_el8.6.0+3248+c431e88c | ALSA-2025:23530 |
| AlmaLinux:8 | python39-psycopg2 | 2.8.6-3.module_el8.10.0+3765+2f9a457d | ALSA-2025:23530 |
| AlmaLinux:8 | python39-psycopg2-doc | 2.8.6-3.module_el8.10.0+3765+2f9a457d | ALSA-2025:23530 |
| AlmaLinux:8 | python39-psycopg2-tests | 2.8.6-3.module_el8.10.0+3765+2f9a457d | ALSA-2025:23530 |
| AlmaLinux:8 | python39-py | 1.10.0-1.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-pybind11 | 2.7.1-1.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-pybind11 | 2.7.1-1.module_el8.6.0+3248+c431e88c | ALSA-2025:23530 |
| AlmaLinux:8 | python39-pybind11-devel | 2.7.1-1.module_el8.6.0+3248+c431e88c | ALSA-2025:23530 |
| AlmaLinux:8 | python39-pybind11-devel | 2.7.1-1.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-pycparser | 2.20-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-pyparsing | 2.4.7-5.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-pysocks | 1.7.1-4.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-pytest | 6.0.2-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-pyyaml | 5.4.1-1.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-pyyaml | 5.4.1-1.module_el8.6.0+3248+c431e88c | ALSA-2025:23530 |
| AlmaLinux:8 | python39-requests | 2.25.0-3.module_el8.9.0+3634+fb2a896c | ALSA-2025:23530 |
| AlmaLinux:8 | python39-rpm-macros | 3.9.25-2.module_el8.10.0+4083+53cad1fb | ALSA-2025:23530 |
| AlmaLinux:8 | python39-scipy | 1.5.4-5.module_el8.9.0+3634+fb2a896c | ALSA-2025:23530 |
| AlmaLinux:8 | python39-setuptools | 50.3.2-7.module_el8.10.0+4040+9207bbc0 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-setuptools-wheel | 50.3.2-7.module_el8.10.0+4040+9207bbc0 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-six | 1.15.0-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-test | 3.9.25-2.module_el8.10.0+4083+53cad1fb | ALSA-2025:23530 |
| AlmaLinux:8 | python39-tkinter | 3.9.25-2.module_el8.10.0+4083+53cad1fb | ALSA-2025:23530 |
| AlmaLinux:8 | python39-toml | 0.10.1-5.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-urllib3 | 1.25.10-5.module_el8.10.0+3765+2f9a457d | ALSA-2025:23530 |
| AlmaLinux:8 | python39-wcwidth | 0.2.5-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-wheel | 1:0.35.1-4.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-wheel-wheel | 1:0.35.1-4.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| Alpine:v3.20 | python3 | 3.12.8-r0 | ALPINE-CVE-2024-9287 |
| Alpine:v3.21 | python3 | 3.12.8-r0 | ALPINE-CVE-2024-9287 |
| Alpine:v3.22 | python3 | 3.12.8-r0 | ALPINE-CVE-2024-9287 |
| Alpine:v3.23 | python3 | 3.12.8-r0 | ALPINE-CVE-2024-9287 |
| Alpine:v3.24 | python3 | 3.12.8-r0 | ALPINE-CVE-2024-9287 |
| Debian:12 | pypy3 | 7.3.11+dfsg-2+deb12u3 | DEBIAN-CVE-2024-9287 |
| Debian:13 | pypy3 | 7.3.17+dfsg-3 | DEBIAN-CVE-2024-9287 |
| Debian:14 | pypy3 | 7.3.17+dfsg-3 | DEBIAN-CVE-2024-9287 |
| Debian:12 | python3.11 | 3.11.2-6+deb12u5 | DEBIAN-CVE-2024-9287 |
| Debian:13 | python3.13 | 3.13.1-1 | DEBIAN-CVE-2024-9287 |
| Rocky Linux:8 | Cython | 0:0.29.21-5.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | Cython | 0:0.29.21-5.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | PyYAML | 0:5.4.1-1.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | PyYAML | 0:5.4.1-1.module+el8.9.0+1418+f0d66789 | RLSA-2025:23530 |
| Rocky Linux:8 | PyYAML | 0:5.4.1-1.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | mod_wsgi | 0:4.7.1-7.module+el8.10.0+1978+d4f111ba.1 | RLSA-2025:23530 |
| Rocky Linux:8 | mod_wsgi | 0:4.7.1-7.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | mod_wsgi | 0:4.7.1-7.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | numpy | 0:1.19.4-3.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | numpy | 0:1.19.4-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | pybind11 | 0:2.7.1-1.module+el8.9.0+1357+a3b80af7 | RLSA-2025:23530 |
| Rocky Linux:8 | pytest | 0:6.0.2-2.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | pytest | 0:6.0.2-2.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-PyMySQL | 0:0.10.1-2.module+el8.10.0+1910+234ad790 | RLSA-2025:23530 |
| Rocky Linux:8 | python-PyMySQL | 0:0.10.1-2.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-PyMySQL | 0:0.10.1-2.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-PyMySQL | 0:0.10.1-2.module+el8.10.0+1592+61442852 | RLSA-2025:23530 |
| Rocky Linux:8 | python-attrs | 0:20.3.0-2.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-attrs | 0:20.3.0-2.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-cffi | 0:1.14.3-2.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-cffi | 0:1.14.3-2.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-chardet | 0:3.0.4-19.module+el8.9.0+1418+f0d66789 | RLSA-2025:23530 |
| Rocky Linux:8 | python-chardet | 0:3.0.4-19.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-chardet | 0:3.0.4-19.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-cryptography | 0:3.3.1-3.module+el8.10.0+1697+7e517775 | RLSA-2025:23530 |
| Rocky Linux:8 | python-cryptography | 0:3.3.1-3.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-idna | 0:2.10-4.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-idna | 0:2.10-4.module+el8.10.0+1809+41195054 | RLSA-2025:23530 |
| Rocky Linux:8 | python-iniconfig | 0:1.1.1-2.module+el8.9.0+1332+dd574197 | RLSA-2025:23530 |
| Rocky Linux:8 | python-lxml | 0:4.6.5-1.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-more-itertools | 0:8.5.0-2.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-more-itertools | 0:8.5.0-2.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-packaging | 0:20.4-4.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-packaging | 0:20.4-4.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-pluggy | 0:0.13.1-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-pluggy | 0:0.13.1-3.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-ply | 0:3.11-10.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-ply | 0:3.11-10.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-ply | 0:3.11-10.module+el8.9.0+1418+f0d66789 | RLSA-2025:23530 |
| Rocky Linux:8 | python-psutil | 0:5.8.0-4.module+el8.9.0+1357+a3b80af7 | RLSA-2025:23530 |
| Rocky Linux:8 | python-psycopg2 | 0:2.8.6-3.module+el8.10.0+1660+b5b6f004 | RLSA-2025:23530 |
| Rocky Linux:8 | python-psycopg2 | 0:2.8.6-3.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-py | 0:1.10.0-1.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-py | 0:1.10.0-1.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-pycparser | 0:2.20-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-pycparser | 0:2.20-3.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-pysocks | 0:1.7.1-4.module+el8.9.0+1418+f0d66789 | RLSA-2025:23530 |
| Rocky Linux:8 | python-pysocks | 0:1.7.1-4.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-pysocks | 0:1.7.1-4.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-requests | 0:2.25.0-3.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-requests | 0:2.25.0-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-toml | 0:0.10.1-5.module+el8.9.0+1332+dd574197 | RLSA-2025:23530 |
| Rocky Linux:8 | python-urllib3 | 0:1.25.10-5.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-urllib3 | 0:1.25.10-5.module+el8.10.0+1545+03246da9 | RLSA-2025:23530 |
| Rocky Linux:8 | python-wcwidth | 0:0.2.5-3.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-wcwidth | 0:0.2.5-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-wheel | 1:0.35.1-4.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-wheel | 1:0.35.1-4.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python3 | 0:3.6.8-69.el8_10.rocky.0 | RLSA-2024:10779 |
| Rocky Linux:8 | python3.11 | 0:3.11.11-1.el8_10 | RLSA-2024:10979 |
| Rocky Linux:9 | python3.11 | 0:3.11.9-7.el9_5.2 | RLSA-2024:11111 |
| Rocky Linux:8 | python3.12 | 0:3.12.8-1.el8_10 | RLSA-2024:10980 |
| Rocky Linux:9 | python3.9 | 0:3.9.21-1.el9_5 | RLSA-2024:10983 |
| Rocky Linux:8 | python3x-pip | 0:20.2.4-9.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python3x-pip | 0:20.2.4-9.module+el8.10.0+1721+e52d6351 | RLSA-2025:23530 |
| Rocky Linux:8 | python3x-pyparsing | 0:2.4.7-5.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python3x-pyparsing | 0:2.4.7-5.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python3x-setuptools | 0:50.3.2-7.module+el8.10.0+2057+30213a2b | RLSA-2025:23530 |
| Rocky Linux:8 | python3x-six | 0:1.15.0-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python3x-six | 0:1.15.0-3.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | scipy | 0:1.5.4-5.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | scipy | 0:1.5.4-5.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Ubuntu:22.04:LTS | python3.10 | 3.10.12-1~22.04.7 | USN-7116-1 |
| Ubuntu:22.04:LTS | python3.10 | 3.10.12-1~22.04.7 | UBUNTU-CVE-2024-9287 |
| Ubuntu:24.04:LTS | python3.12 | 3.12.3-1ubuntu0.3 | UBUNTU-CVE-2024-9287 |
| Ubuntu:24.04:LTS | python3.12 | 3.12.3-1ubuntu0.3 | USN-7116-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Python Software Foundation | CPython | 0 – before 3.9.213.10.0 – before 3.10.163.11.0 – before 3.11.113.12.0 – before 3.12.83.13.0 – before 3.13.13.14.0a1 – before 3.14.0a2 |
Weakness: CWE-428 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Green
References
- https://github.com/python/cpython/issues/124651 issue-tracking
- https://github.com/python/cpython/pull/124712 patch
- https://mail.python.org/archives/list/security-announce@python.org/thread/RSPJ2B5JL22FG3TKUJ7D7DQ4N5JRRBZL/ vendor-advisory
- https://github.com/python/cpython/commit/e52095a0c1005a87eed2276af7a1f2f66e2b6483 patch
- https://github.com/python/cpython/commit/633555735a023d3e4d92ba31da35b1205f9ecbd7 patch
- https://github.com/python/cpython/commit/8450b2482586857d689b6658f08de9c8179af7db patch
- https://github.com/python/cpython/commit/9286ab3a107ea41bd3f3c3682ce2512692bdded8 patch
- https://github.com/python/cpython/commit/ae961ae94bf19c8f8c7fbea3d1c25cc55ce8ae97 patch
- https://github.com/python/cpython/commit/d48cc82ed25e26b02eb97c6263d95dcaa1e9111b patch
- https://security.netapp.com/advisory/ntap-20250425-0006/
- https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html