Threats Tagged 'bit-python-2024-9287'

CVE-2024-9287 is a vulnerability in the Python CPython venv module where activation scripts do not properly quote path names. This allows an attacker who creates a malicious virtual environment to inject commands that execute when the environment is activated using the 'source venv/bin/activate' command. Virtual environments created by trusted users or those used without activation (e.g., directly invoking the Python binary) are not affected. The issue affects multiple Python versions from 3.6.8 through versions prior to fixed releases in 3.9.21, 3.10.16, 3.11.11, 3.12.8, and 3.13.1. A patch is available and has been issued by Red Hat and other vendors. The severity is assessed as medium.