https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 23:51:18 +0000 https://cve.radiocsirt.org/vuln/alsa-2024:10779 <p><strong>Affected:</strong> AlmaLinux:8: platform-python, AlmaLinux:8: platform-python-debug, AlmaLinux:8: platform-python-devel, AlmaLinux:8: python3-idle, AlmaLinux:8: python3-libs, AlmaLinux:8: python3-test, AlmaLinux:8: python3-tkinter</p> <p>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.</p> <p>Security Fix(es):</p> <p>* python: Virtual environment (venv) activation scripts don&#39;t quote paths (CVE-2024-9287) * python: Improper validation of IPv6 and IPvFuture addresses (CVE-2024-11168)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: platform-python, AlmaLinux:8: platform-python-debug, AlmaLinux:8: platform-python-devel, AlmaLinux:8: python3-idle, AlmaLinux:8: python3-libs, AlmaLinux:8: python3-test, AlmaLinux:8: python3-tkinter</p> <p>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.</p> <p>Security Fix(es):</p> <p>* python: Virtual environment (venv) activation scripts don&#39;t quote paths (CVE-2024-9287) * python: Improper validation of IPv6 and IPvFuture addresses (CVE-2024-11168)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2024:10779 https://cve.radiocsirt.org/vuln/bdu:2025-03332 bdu:2025-03332 https://cve.radiocsirt.org/vuln/bdu:2025-03332 https://cve.radiocsirt.org/vuln/bell-cve-2024-9287 <p><strong>Affected:</strong> Alpaquita:23: python3, Alpaquita:stream: python3, BellSoft Hardened Containers:23: python3, BellSoft Hardened Containers:stream: python3</p> <p><strong>Affected:</strong> Alpaquita:23: python3, Alpaquita:stream: python3, BellSoft Hardened Containers:23: python3, BellSoft Hardened Containers:stream: python3</p> https://cve.radiocsirt.org/vuln/bell-cve-2024-9287 https://cve.radiocsirt.org/vuln/bit-libpython-2024-9287 <p><strong>Affected:</strong> Bitnami: libpython</p> <p>A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment &#34;activation&#34; scripts (ie &#34;source venv/bin/activate&#34;). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren&#39;t activated before being used (ie &#34;./venv/bin/python&#34;) are not affected.</p> <p><strong>Affected:</strong> Bitnami: libpython</p> <p>A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment &#34;activation&#34; scripts (ie &#34;source venv/bin/activate&#34;). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren&#39;t activated before being used (ie &#34;./venv/bin/python&#34;) are not affected.</p> https://cve.radiocsirt.org/vuln/bit-libpython-2024-9287 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0422 certfr-2025-avi-0422 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0422 https://cve.radiocsirt.org/vuln/cleanstart-2026-ci66802 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: cassandra-fips</p> <p>Multiple security vulnerabilities affect the cassandra-fips package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: cassandra-fips</p> <p>Multiple security vulnerabilities affect the cassandra-fips package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ci66802 https://cve.radiocsirt.org/vuln/euvd-2026-258733 EUVD-2026-258733 https://cve.radiocsirt.org/vuln/euvd-2026-258733 https://cve.radiocsirt.org/vuln/fkie_cve-2024-9287 <p>A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment &#34;activation&#34; scripts (ie &#34;source venv/bin/activate&#34;). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren&#39;t activated before being used (ie &#34;./venv/bin/python&#34;) are not affected.</p> <p>A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment &#34;activation&#34; scripts (ie &#34;source venv/bin/activate&#34;). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren&#39;t activated before being used (ie &#34;./venv/bin/python&#34;) are not affected.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-9287 https://cve.radiocsirt.org/vuln/ghsa-grqq-hcc7-crmr <p>A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment &#34;activation&#34; scripts (ie &#34;source venv/bin/activate&#34;). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren&#39;t activated before being used (ie &#34;./venv/bin/python&#34;) are not affected.</p> <p>A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment &#34;activation&#34; scripts (ie &#34;source venv/bin/activate&#34;). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren&#39;t activated before being used (ie &#34;./venv/bin/python&#34;) are not affected.</p> https://cve.radiocsirt.org/vuln/ghsa-grqq-hcc7-crmr https://cve.radiocsirt.org/vuln/msrc_cve-2024-9287 msrc_CVE-2024-9287 https://cve.radiocsirt.org/vuln/msrc_cve-2024-9287 https://cve.radiocsirt.org/vuln/oesa-2024-2481 <p><strong>Affected:</strong> openEuler:24.03-LTS: python3</p> <p>Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. Security Fix(es): A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment &amp;quot;activation&amp;quot; scripts (ie &amp;quot;source venv/bin/activate&amp;quot;). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren&amp;apos;t activated before being used (ie &amp;quot;./venv/bin/python&amp;quot;) are not affected.(CVE-2024-9287)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS: python3</p> <p>Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. Security Fix(es): A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment &amp;quot;activation&amp;quot; scripts (ie &amp;quot;source venv/bin/activate&amp;quot;). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren&amp;apos;t activated before being used (ie &amp;quot;./venv/bin/python&amp;quot;) are not affected.(CVE-2024-9287)</p> https://cve.radiocsirt.org/vuln/oesa-2024-2481 https://cve.radiocsirt.org/vuln/opensuse-su-2024:14426-1 <p>python310-virtualenv-20.26.6-1.1 on GA media</p> <p>python310-virtualenv-20.26.6-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:14426-1 https://cve.radiocsirt.org/vuln/rhba-2025:6294 <p>python: cpython: tarfile: ReDos via excessive backtracking while parsing header values python: Virtual environment (venv) activation scripts don&#39;t quote paths python: Unbounded memory buffering in SelectorSocketTransport.writelines() python: cpython: URL parser allowed square brackets in domain names</p> <p>python: cpython: tarfile: ReDos via excessive backtracking while parsing header values python: Virtual environment (venv) activation scripts don&#39;t quote paths python: Unbounded memory buffering in SelectorSocketTransport.writelines() python: cpython: URL parser allowed square brackets in domain names</p> https://cve.radiocsirt.org/vuln/rhba-2025:6294 https://cve.radiocsirt.org/vuln/suse-su-2024:3760-1 <p>Security update for python3</p> <p>Security update for python3</p> https://cve.radiocsirt.org/vuln/suse-su-2024:3760-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-9287 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python3.4, Ubuntu:Pro:14.04:LTS: python3.5, Ubuntu:Pro:16.04:LTS: python3.5, Ubuntu:Pro:18.04:LTS: python3.6, Ubuntu:Pro:18.04:LTS: python3.7, Ubuntu:Pro:18.04:LTS: python3.8, Ubuntu:20.04:LTS: python3.8, Ubuntu:Pro:20.04:LTS: python3.9, Ubuntu:22.04:LTS: python3.10, Ubuntu:Pro:22.04:LTS: python3.11 and 1 more</p> <p>A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment &#34;activation&#34; scripts (ie &#34;source venv/bin/activate&#34;). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren&#39;t activated before being used (ie &#34;./venv/bin/python&#34;) are not affected.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python3.4, Ubuntu:Pro:14.04:LTS: python3.5, Ubuntu:Pro:16.04:LTS: python3.5, Ubuntu:Pro:18.04:LTS: python3.6, Ubuntu:Pro:18.04:LTS: python3.7, Ubuntu:Pro:18.04:LTS: python3.8, Ubuntu:20.04:LTS: python3.8, Ubuntu:Pro:20.04:LTS: python3.9, Ubuntu:22.04:LTS: python3.10, Ubuntu:Pro:22.04:LTS: python3.11 and 1 more</p> <p>A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment &#34;activation&#34; scripts (ie &#34;source venv/bin/activate&#34;). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren&#39;t activated before being used (ie &#34;./venv/bin/python&#34;) are not affected.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-9287 https://cve.radiocsirt.org/vuln/vde-2025-053 <p>Coreutils: heap overflow in split --line-bytes with very long lines Unprivileged overlay + shiftfs read access Nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file SSL_select_next_proto buffer overread Remote Code Execution in pypa/setuptools</p> <p>Coreutils: heap overflow in split --line-bytes with very long lines Unprivileged overlay + shiftfs read access Nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file SSL_select_next_proto buffer overread Remote Code Execution in pypa/setuptools</p> https://cve.radiocsirt.org/vuln/vde-2025-053 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3270 <p>Ein lokaler Angreifer kann eine Schwachstelle in Python und Red Hat Enterprise Linux ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein lokaler Angreifer kann eine Schwachstelle in Python und Red Hat Enterprise Linux ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3270