CVE-2024-9287 json
Virtual environment (venv) activation scripts don't quote paths
published 2024-10-22 2 y ago modified 2026-10-30 9 d ago also BIT-libpython-2024-9287 , BIT-python-2024-9287 , BIT-python-min-2024-9287 , EUVD-2024-50376
- cvss
- 7.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 51%
- public exploits
- 0
- none known
Summary
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.
Patch / fix
- bitnami libpython 3.9.21, 3.10.16, 3.11.11, 3.12.8, 3.13.1
- bitnami python 3.9.21, 3.10.16, 3.11.11, 3.12.8, 3.13.1
- bitnami python-min 3.9.21, 3.10.16, 3.11.11, 3.12.8, 3.13.1
- Python Software Foundation CPython 3.9.21, 3.10.16, 3.11.11, 3.12.8, 3.13.1, 3.14.0a2
- pypy3 Debian 12 7.3.11+dfsg-2+deb12u3
- pypy3 Debian 14, Debian 13 7.3.17+dfsg-3
- python3.11 Debian 12 3.11.2-6+deb12u5
- python3.13 Debian 13 3.13.1-1
debian advisories DEBIAN-CVE-2024-9287
- python3.8 Ubuntu 20.04 LTS 3.8.10-0ubuntu1~20.04.16
- python3.10 Ubuntu 22.04 LTS 3.10.12-1~22.04.7
- python3.12 Ubuntu 24.04 LTS 3.12.3-1ubuntu0.3
- python3.4 Ubuntu Pro 14.04 LTS 3.4.3-1ubuntu1~14.04.7+esm14
- python3.5 Ubuntu Pro 14.04 LTS 3.5.2-2ubuntu0~16.04.4~14.04.1+esm4
- python3.5 Ubuntu Pro 16.04 LTS 3.5.2-2ubuntu0~16.04.13+esm16
- python3.6 Ubuntu Pro 18.04 LTS 3.6.9-1~18.04ubuntu1.13+esm3
- python3.7 Ubuntu Pro 18.04 LTS 3.7.5-2ubuntu1~18.04.2+esm4
ubuntu advisories UBUNTU-CVE-2024-9287
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- python3.12 RHEL 10.0 3.12.9-1.el10
- python3 RHEL 10.0 3.12.9-1.el10
- python3-idle RHEL 10.0 3.12.9-1.el10
- python3-libs RHEL 10.0 3.12.9-1.el10
- python3-test RHEL 10.0 3.12.9-1.el10
- python3-tkinter RHEL 10.0 3.12.9-1.el10
- python-unversioned-command RHEL 10.0 3.12.9-1.el10
- numpy RHEL 8 1.19.4-3.module+el8.9.0+19644+d68f775d
red hat advisories RHBA-2025:6294RHSA-2025:23530RHSA-2025:0280RHSA-2024:11111RHSA-2024:11035RHSA-2024:11024
- python313 SLE Module for Python 3 15 SP7 3.13.5-150700.4.11.1
- python313-core SLE Module for Python 3 15 SP7 3.13.5-150700.4.11.1
- python311 Linux Micro 6.1 3.11.12-slfo.1.1_1.1
- python311-core Linux Micro 6.1 3.11.12-slfo.1.1_1.1
- python311 Linux Micro 6.0 3.11.11-1.1
- python311-core Linux Micro 6.0 3.11.11-1.1
- python310 openSUSE Leap 15.6 3.10.16-150400.4.66.1
- python310-core openSUSE Leap 15.6 3.10.16-150400.4.66.1
suse advisories SUSE-SU-2025:02074-1SUSE-SU-2025:20374-1SUSE-SU-2025:20154-1SUSE-SU-2025:0049-1SUSE-SU-2025:0048-1SUSE-SU-2025:0047-1
- python-virtualenv openSUSE Tumbleweed 21.14.2-1.1
- python311 openSUSE Tumbleweed 3.11.10-3.1
- python312 openSUSE Tumbleweed 3.12.7-2.1
- python313 openSUSE Tumbleweed 3.13.0-3.1
- python-virtualenv openSUSE Tumbleweed 20.26.6-1.1
- python310 openSUSE Tumbleweed 3.10.15-2.1
- python39 openSUSE Tumbleweed 3.9.20-4.1
opensuse advisories openSUSE-SU-2026:11974-1openSUSE-SU-2024:14455-1openSUSE-SU-2024:14456-1openSUSE-SU-2024:14430-1openSUSE-SU-2024:14426-1openSUSE-SU-2024:14427-1
- python39 AlmaLinux 8 3.9.25-2.module_el8.10.0+4083+53cad1fb
- python39-py AlmaLinux 8 1.10.0-1.module_el8.6.0+2780+a40f65e1
- python39-pip AlmaLinux 8 20.2.4-9.module_el8.10.0+3765+2f9a457d
- python39-ply AlmaLinux 8 3.11-10.module_el8.6.0+2780+a40f65e1
- python39-six AlmaLinux 8 1.15.0-3.module_el8.6.0+2780+a40f65e1
- python39-cffi AlmaLinux 8 1.14.3-2.module_el8.6.0+2780+a40f65e1
- python39-cffi AlmaLinux 8 1.14.3-2.module_el8.6.0+3248+c431e88c
- python39-idle AlmaLinux 8 3.9.25-2.module_el8.10.0+4083+53cad1fb
almalinux advisories ALSA-2025:23530ALSA-2024:11111ALSA-2024:10978ALSA-2024:10979ALSA-2024:10980ALSA-2024:10983
- numpy Rocky Linux 8 1.19.4-3.module+el8.10.0+1582+bc278001
- numpy Rocky Linux 8 1.19.4-3.module+el8.10.0+1860+afcc1c71
- scipy Rocky Linux 8 1.5.4-5.module+el8.10.0+1860+afcc1c71
- scipy Rocky Linux 8 1.5.4-5.module+el8.10.0+1582+bc278001
- Cython Rocky Linux 8 0.29.21-5.module+el8.10.0+1582+bc278001
- Cython Rocky Linux 8 0.29.21-5.module+el8.10.0+1860+afcc1c71
- pytest Rocky Linux 8 6.0.2-2.module+el8.10.0+1860+afcc1c71
- pytest Rocky Linux 8 6.0.2-2.module+el8.10.0+1582+bc278001
rocky linux advisories RLSA-2025:23530RLSA-2024:10978RLSA-2024:11111RLSA-2024:10983RLSA-2024:10979RLSA-2024:10980
- python3 Alpine 3.19, Alpine 3.18 3.11.11-r0
- python3 Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 3.12.8-r0
alpine advisories ALPINE-CVE-2024-9287
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- python3 CBL-Mariner 2.0 3.9.19-11
- python3 Azure Linux 3.0 3.12.9-1
azure linux advisories AZL-50757AZL-50926
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
- github.com/python/cpython@e52095a commit
- github.com/python/cpython@6335557 commit
- github.com/python/cpython@8450b24 commit
- github.com/python/cpython@9286ab3 commit
- github.com/python/cpython@ae961ae commit
- github.com/python/cpython@d48cc82 commit
- github.com/python/cpython#124712 pull request
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2024-9287 updated cvss 6.3
python: Virtual environment (venv) activation scripts don't quote paths
-
Red Hat Enterprise Linux 7 python, python3, tkinter, python-libs, python-test, python-tools, +4 moreaffected: workaround, no fix planned “Out of support scope”
-
Red Hat CodeReady Linux Builder (v. 9) python3 3.9.21-1.el9_5, python3-idle 3.9.21-1.el9_5, python3-test 3.9.21-1.el9_5, python3.11 3.11.9-7.el9_5.2, python3.12 3.12.5-2.el9_5.2, python3-tkinter 3.9.21-1.el9_5, +6 morefixed: vendor fix RHSA-2024:10983
-
Red Hat CodeReady Linux Builder EUS (v.9.4) python3 3.9.18-3.el9_4.7, python3.11 3.11.7-1.el9_4.7, python3.12 3.12.1-4.el9_4.5, python3-idle 3.9.18-3.el9_4.7, python3-test 3.9.18-3.el9_4.7, python3-tkinter 3.9.18-3.el9_4.7, +6 morefixed: vendor fix RHSA-2024:11024
-
Red Hat Enterprise Linux AppStream (v. 8) python3.12 3.12.8-1.el8_10, python3.11 3.11.11-1.el8_10, python3-idle 3.6.8-69.el8_10, python3-test 3.6.8-69.el8_10, platform-python 3.6.8-69.el8_10, python3-tkinter 3.6.8-69.el8_10, +61 morefixed: vendor fix RHSA-2025:23530
-
Red Hat Enterprise Linux AppStream (v. 9) python3.11 3.11.9-7.el9_5.2, python3.12 3.12.5-2.el9_5.2, python3-tkinter 3.9.21-1.el9_5, python3.11-libs 3.11.9-7.el9_5.2, python3.12-libs 3.12.5-2.el9_5.2, python3.11-tkinter 3.11.9-7.el9_5.2, +2 morefixed: vendor fix RHSA-2024:10983
-
Red Hat Enterprise Linux AppStream (v. 10) python3-tkinter 3.12.9-1.el10, python-unversioned-command 3.12.9-1.el10fixed: vendor fix RHBA-2025:6294
-
Red Hat Enterprise Linux AppStream EUS (v.9.4) python3.11 3.11.7-1.el9_4.7, python3.12 3.12.1-4.el9_4.5, python3-tkinter 3.9.18-3.el9_4.7, python3.11-libs 3.11.7-1.el9_4.7, python3.12-libs 3.12.1-4.el9_4.5, python3.11-tkinter 3.11.7-1.el9_4.7, +2 morefixed: vendor fix RHSA-2024:11024
-
Red Hat Enterprise Linux BaseOS (v. 8) python3 3.6.8-69.el8_10, python3-libs 3.6.8-69.el8_10, python3-test 3.6.8-69.el8_10, platform-python 3.6.8-69.el8_10fixed: vendor fix RHSA-2024:10779
show 6 moreshow fewer
-
Red Hat Enterprise Linux BaseOS (v. 9) python3 3.9.21-1.el9_5, python3.9 3.9.21-1.el9_5, python3-libs 3.9.21-1.el9_5fixed: vendor fix RHSA-2024:10983
-
Red Hat Enterprise Linux BaseOS (v. 10) python3 3.12.9-1.el10, python3.12 3.12.9-1.el10, python3-libs 3.12.9-1.el10fixed: vendor fix RHBA-2025:6294
-
Red Hat Enterprise Linux BaseOS EUS (v.9.4) python3 3.9.18-3.el9_4.7, python3.9 3.9.18-3.el9_4.7, python3-libs 3.9.18-3.el9_4.7fixed: vendor fix RHSA-2024:11024
-
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) python3-idle 3.12.9-1.el10, python3-test 3.12.9-1.el10fixed: vendor fix RHBA-2025:6294
-
Red Hat Enterprise Linux CRB (v. 8) python3.12 3.12.8-1.el8_10, python3.11 3.11.11-1.el8_10, python3.12-idle 3.12.8-1.el8_10, python3.12-test 3.12.8-1.el8_10, python3.11-idle 3.11.11-1.el8_10, python3.11-test 3.11.11-1.el8_10, +24 morefixed: vendor fix RHSA-2025:23530
-
Red Hat Enterprise Linux 8 scipy, python36, python-nose, python-wheel, python3-bson, python3-nose, +19 morenot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 15 mo ago
Exploit prediction
0.65% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Green |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green |
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | libpython | <3.9.21 >=3.10.0, <3.10.16 >=3.11.0, <3.11.11 >=3.12.0, <3.12.8 >=3.13.0, <3.13.1 |
3.9.21 3.10.16 3.11.11 3.12.8 3.13.1 |
| bitnami | python | <3.9.21 >=3.10.0, <3.10.16 >=3.11.0, <3.11.11 >=3.12.0, <3.12.8 >=3.13.0, <3.13.1 |
3.9.21 3.10.16 3.11.11 3.12.8 3.13.1 |
| bitnami | python-min | <3.9.21 >=3.10.0, <3.10.16 >=3.11.0, <3.11.11 >=3.12.0, <3.12.8 >=3.13.0, <3.13.1 |
3.9.21 3.10.16 3.11.11 3.12.8 3.13.1 |
Affected products
- Python Software Foundation CPython
Classification
References
-
github.com
/python/cpython/pull/124712
patch, issue-tracking
-
github.com
/python/cpython/commit/e52095a0c1005a87eed2276af7a1f2f66e2b6483
patch
-
github.com
/python/cpython/commit/633555735a023d3e4d92ba31da35b1205f9ecbd7
patch
-
github.com
/python/cpython/commit/8450b2482586857d689b6658f08de9c8179af7db
patch
-
github.com
/python/cpython/commit/9286ab3a107ea41bd3f3c3682ce2512692bdded8
patch
-
github.com
/python/cpython/commit/ae961ae94bf19c8f8c7fbea3d1c25cc55ce8ae97
patch
-
github.com
/python/cpython/commit/d48cc82ed25e26b02eb97c6263d95dcaa1e9111b
patch
-
mail.python.org
/archives/list/security-announce@python.org/thread/RSPJ2B5JL22FG3TKUJ7D7DQ4N5JRRBZL/
vendor-advisory, advisory
-
github.com
/python/cpython/issues/124651
issue-tracking, report
-
security.netapp.com
/advisory/ntap-20250425-0006/
web
-
lists.debian.org
/debian-lts-announce/2024/12/msg00000.html
web
-
lists.debian.org
/debian-lts-announce/2024/11/msg00024.html
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-9287
web
Sources
- CVE List CVE-2024-9287
- NVD CVE-2024-9287
- OSV BIT-libpython-2024-9287
- OSV BIT-python-2024-9287
- OSV BIT-python-min-2024-9287
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.