Bug 2328554 (CVE-2024-53899)
| Summary: | CVE-2024-53899 virtualenv: potential command injection via virtual environment activation scripts | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | anpicker, aprice, bdettelb, bparees, caswilli, doconnor, ehelms, ggainey, gkamathe, hasun, jfula, jmitchel, jowilson, jsamir, jtanner, juwatts, jwong, kaycoth, kgaikwad, kholdawa, kshier, mhulan, mpierce, nmoumoul, nyancey, ometelka, orabin, pcreech, psegedy, ptisnovs, rchan, sdawley, smallamp, stcannon, sthirugn, syedriko, teagle, vkrizan, xdharmai, xiaoxwan, zzhou |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A flaw was found in the virtualenv Python package. Due to the improper handling of quotes in magic template strings, the virtual environment activation script is vulnerable to OS command injection,leading to the loss of confidentiality,integrity and availability of the system.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2328744, 2328745, 2328746, 2328747, 2328748, 2328749, 2328750 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2024-11-24 17:01:25 UTC
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:10953 https://access.redhat.com/errata/RHSA-2024:10953 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2024:11048 https://access.redhat.com/errata/RHSA-2024:11048 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Advanced Update Support Via RHSA-2024:11091 https://access.redhat.com/errata/RHSA-2024:11091 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Extended Update Support Via RHSA-2024:11093 https://access.redhat.com/errata/RHSA-2024:11093 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat Enterprise Linux 8.6 Telecommunications Update Service Via RHSA-2024:11094 https://access.redhat.com/errata/RHSA-2024:11094 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Telecommunications Update Service Via RHSA-2025:0002 https://access.redhat.com/errata/RHSA-2025:0002 |