virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0002 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * virtualenv: potential command injection via virtual environment activation scripts (CVE-2024-53899)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:10953 advisory.

    * virtualenv: potential command injection via virtual environment activation scripts (CVE-2024-53899)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:10953 advisory.

    * virtualenv: potential command injection via virtual environment activation scripts (CVE-2024-53899)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:11091 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * virtualenv: potential command injection via virtual environment activation scripts (CVE-2024-53899)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:11094 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * virtualenv: potential command injection via virtual environment activation scripts (CVE-2024-53899)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:11093 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * virtualenv: potential command injection via virtual environment activation scripts (CVE-2024-53899)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:11048 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware     platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual     machines using KVM.The packages also provide APIs for managing and interacting with the virtualized     systems.

    Security Fix(es):

    * virtualenv: potential command injection via virtual environment activation scripts (CVE-2024-53899)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-10953 advisory.

    python36     python-distro     python-docs     python-docutils     python-nose     python-pygments     python-pymongo     python-PyMySQL     python-sqlalchemy     python-virtualenv     [15.1.0-23]
    - Security fix for CVE-2024-53899     Resolves: RHEL-68876

    python-wheel     scipy

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:4093-1 advisory.

    - CVE-2024-53899: Fixed a command injection through activation scripts (bsc#1233706)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:4143-1 advisory.

    Security issue fixed:

    - CVE-2024-53899: Fixed a command injection through activation scripts (bsc#1233706)

    Non-security issue fixed:

    - Relax version requirements that cannot be provided (bsc#1232072)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:10953 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * virtualenv: potential command injection via virtual environment activation scripts (CVE-2024-53899)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-8568f9cd5e advisory.

    Update `uv` from 0.4.30 to 0.5.5. This is a significant update. Please see the following notes.

    ----

    By updating to a current release of `uv`, this update fixes     [CVE-2024-53899](https://nvd.nist.gov/vuln/detail/CVE-2024-53899), which was originally reported against     [`virtualenv`](https://pypi.org/project/virtualenv/) but which was also reproducible on `uv` 0.5.2 and     earlier. See [upstream issue #9424](https://github.com/astral-sh/uv/issues/9424) for more details.

    ----

    This update adds a default system-wide configuration file `/etc/uv/uv.toml` with settings specific to     Fedora. The RPM-packaged `uv` now deviates from the default configuration in two ways.

    First, we set `python-downloads` to `manual` in order to avoid unintended Python downloads. We suggest     using RPM-packaged (system) Pythons that benefit from distribution maintenance and integration. Use `uv     python install` to manually install managed Pythons.

    Second, we set `python-preference` to `system` instead of `managed`. Otherwise, any managed Python     would be used for `uv` operations where no particular Python is specified, even if the only available     managed Python were much older than the primary system Python.

    No choices can be appropriate for all users and applications. To restore the default behavior, comment out     settings in this file or override them in a configuration file with higher precedence, such as a user-     level configuration file. See https://docs.astral.sh/uv/configuration/files/ for details on the     interaction of project-, user-, and system-level configuration files.

    ----

    With 0.5.0, `uv` introduced several potentially breaking changes. The developers write that these are     changes that improve correctness and user experience, but could break some workflows. This release     contains those changes; many have been marked as breaking out of an abundance of caution. We expect most     users to be able to upgrade without making changes.

    - Use base executable to set virtualenv Python path
    - Use XDG (i.e. `~/.local/bin`) instead of the Cargo home directory in the installer
    - Discover and respect .python-version files in parent directories
    - Error when disallowed settings are defined in `uv.toml`
    - Implement PEP 440-compliant local version semantics
    - Treat the base Conda environment as a system environment
    - Do not allow pre-releases when the `!=` operator is used
    - Prefer `USERPROFILE` over `FOLDERID_Profile` when selecting a home directory on Windows
    - Improve interactions between color environment variables and CLI options
    - Make `allow-insecure-host` a global option
    - Only write `.python-version` files during `uv init` for workspace members if the version differs

    For detailed discussion of these changes, please see https://github.com/astral-sh/uv/releases/tag/0.5.0.

    For other fixes, enhancements, and changes in this update, please consult the following:

    - https://github.com/astral-sh/uv/releases/tag/0.5.1
    - https://github.com/astral-sh/uv/releases/tag/0.5.2
    - https://github.com/astral-sh/uv/releases/tag/0.5.3
    - https://github.com/astral-sh/uv/releases/tag/0.5.4
    - https://github.com/astral-sh/uv/releases/tag/0.5.5


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-075f626765 advisory.

    Update `uv` from 0.4.30 to 0.5.5. This is a significant update. Please see the following notes.

    ----

    By updating to a current release of `uv`, this update fixes     [CVE-2024-53899](https://nvd.nist.gov/vuln/detail/CVE-2024-53899), which was originally reported against     [`virtualenv`](https://pypi.org/project/virtualenv/) but which was also reproducible on `uv` 0.5.2 and     earlier. See [upstream issue #9424](https://github.com/astral-sh/uv/issues/9424) for more details.

    ----

    This update adds a default system-wide configuration file `/etc/uv/uv.toml` with settings specific to     Fedora. The RPM-packaged `uv` now deviates from the default configuration in two ways.

    First, we set `python-downloads` to `manual` in order to avoid unintended Python downloads. We suggest     using RPM-packaged (system) Pythons that benefit from distribution maintenance and integration. Use `uv     python install` to manually install managed Pythons.

    Second, we set `python-preference` to `system` instead of `managed`. Otherwise, any managed Python     would be used for `uv` operations where no particular Python is specified, even if the only available     managed Python were much older than the primary system Python.

    No choices can be appropriate for all users and applications. To restore the default behavior, comment out     settings in this file or override them in a configuration file with higher precedence, such as a user-     level configuration file. See https://docs.astral.sh/uv/configuration/files/ for details on the     interaction of project-, user-, and system-level configuration files.

    ----

    With 0.5.0, `uv` introduced several potentially breaking changes. The developers write that these are     changes that improve correctness and user experience, but could break some workflows. This release     contains those changes; many have been marked as breaking out of an abundance of caution. We expect most     users to be able to upgrade without making changes.

    - Use base executable to set virtualenv Python path
    - Use XDG (i.e. `~/.local/bin`) instead of the Cargo home directory in the installer
    - Discover and respect .python-version files in parent directories
    - Error when disallowed settings are defined in `uv.toml`
    - Implement PEP 440-compliant local version semantics
    - Treat the base Conda environment as a system environment
    - Do not allow pre-releases when the `!=` operator is used
    - Prefer `USERPROFILE` over `FOLDERID_Profile` when selecting a home directory on Windows
    - Improve interactions between color environment variables and CLI options
    - Make `allow-insecure-host` a global option
    - Only write `.python-version` files during `uv init` for workspace members if the version differs

    For detailed discussion of these changes, please see https://github.com/astral-sh/uv/releases/tag/0.5.0.

    For other fixes, enhancements, and changes in this update, please consult the following:

    - https://github.com/astral-sh/uv/releases/tag/0.5.1
    - https://github.com/astral-sh/uv/releases/tag/0.5.2
    - https://github.com/astral-sh/uv/releases/tag/0.5.3
    - https://github.com/astral-sh/uv/releases/tag/0.5.4
    - https://github.com/astral-sh/uv/releases/tag/0.5.5

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
213453	RHEL 8 : python36:3.6 (RHSA-2025:0002)	Nessus	Red Hat Local Security Checks	critical
213246	AlmaLinux 8 : python36:3.6 (ALSA-2024:10953)	Nessus	Alma Linux Local Security Checks	critical
213231	RockyLinux 8 : python36:3.6 (RLSA-2024:10953)	Nessus	Rocky Linux Local Security Checks	critical
213114	RHEL 8 : python36:3.6 (RHSA-2024:11091)	Nessus	Red Hat Local Security Checks	critical
213108	RHEL 8 : python36:3.6 (RHSA-2024:11094)	Nessus	Red Hat Local Security Checks	critical
213107	RHEL 8 : python36:3.6 (RHSA-2024:11093)	Nessus	Red Hat Local Security Checks	critical
213092	RHEL 7 : python-virtualenv (RHSA-2024:11048)	Nessus	Red Hat Local Security Checks	critical
212716	Oracle Linux 8 : python36:3.6 (ELSA-2024-10953)	Nessus	Oracle Linux Local Security Checks	critical
212557	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-virtualenv (SUSE-SU-2024:4093-1)	Nessus	SuSE Local Security Checks	critical
212518	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python3-virtualenv (SUSE-SU-2024:4143-1)	Nessus	SuSE Local Security Checks	critical
212505	RHEL 8 : python36:3.6 (RHSA-2024:10953)	Nessus	Red Hat Local Security Checks	critical
212152	Fedora 41 : uv (2024-8568f9cd5e)	Nessus	Fedora Local Security Checks	critical
212151	Fedora 40 : uv (2024-075f626765)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2024-53899

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical