CVE-2024-9287
highPriorität · verfolgen · 31EPSS 0.006 · 51. PerzentilDEEUFRRUUSEPSS · bewertet 2026-10-27
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenFirmware < 2025.0.2 installed on AXC F 1152phoenix_contact_psirt
Update to the latest 2025.0.2 Firmware Release. PHOENIX CONTACT recommends to always use an up-to-date version of the PLCnext Engineer.
- BehobenFirmware < 2025.0.2 installed on AXC F 2152phoenix_contact_psirt
Update to the latest 2025.0.2 Firmware Release. PHOENIX CONTACT recommends to always use an up-to-date version of the PLCnext Engineer.
- BehobenFirmware < 2025.0.2 installed on AXC F 3152phoenix_contact_psirt
Update to the latest 2025.0.2 Firmware Release. PHOENIX CONTACT recommends to always use an up-to-date version of the PLCnext Engineer.
- BehobenFirmware < 2025.0.2 installed on BPC 9102Sphoenix_contact_psirt
Update to the latest 2025.0.2 Firmware Release. PHOENIX CONTACT recommends to always use an up-to-date version of the PLCnext Engineer.
- BehobenFirmware < 2025.0.2 installed on RFC 4072Sphoenix_contact_psirt
Update to the latest 2025.0.2 Firmware Release. PHOENIX CONTACT recommends to always use an up-to-date version of the PLCnext Engineer.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–high · 1.7–7.8
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (123)
Betroffene Produkte und Versionsbereiche.
- Dell PowerProtect Data Domain Management Centeralle Versionencert_bundDEcpe:/a:dell:powerprotect_data_domain_management_center:-
- IBM App Connect Enterprise Certified Containeralle Versionencert_bundDEcpe:/a:ibm:app_connect_enterprise:certified_container
- IBM InfoSphere Information Server 11.7alle Versionencert_bundDEcpe:/a:ibm:infosphere_information_server:11.7
- NetApp ActiveIQ Unified Manager for Microsoft Windowsalle Versionencert_bundDEcpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows
- Red Hat Enterprise Linux Service Interconnect 1alle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:service_interconnect_1
Advisories (10)
Hersteller- und Ökosystem-Meldungen dazu.
- VDE-2025-053Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware2025-07-08csaf · phoenix_contact_psirtDE
Multiple Linux component vulnerabilities fixed in latest PLCnext Firmware release 2025.0.2
- WID-SEC-W-2024-3270Python: Schwachstelle ermöglicht CodeausführungDeutsch2024-10-24csaf · cert_bundDE
Ein lokaler Angreifer kann eine Schwachstelle in Python und Red Hat Enterprise Linux ausnutzen, um beliebigen Programmcode auszuführen.
- WID-SEC-W-2025-1559Oracle Communications: Mehrere SchwachstellenDeutsch2025-07-15csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2025-1560Oracle Communications Applications: Mehrere SchwachstellenDeutsch2025-07-15csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2025-1567Oracle MySQL: Mehrere SchwachstellenDeutsch2025-07-15csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- BIT-libpython-2024-9287Virtual environment (venv) activation scripts don't quote paths2025-08-11vendor · osvUS
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.
- BIT-python-2024-9287Virtual environment (venv) activation scripts don't quote paths2024-12-13vendor · osvUS
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.
- BIT-python-min-2024-9287Virtual environment (venv) activation scripts don't quote paths2025-01-17vendor · osvUS
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.
- CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
- PSF-2024-122024-10-22vendor · osvUS
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.
auch bekannt als (8)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-202410-2549cnnvd
- EUVD-2024-50376enisa_euvd
- BDU:2025-03332fstec_bdu
- GHSA-grqq-hcc7-crmrenisa_euvd
- BIT-libpython-2024-9287osv
- BIT-python-2024-9287osv
- BIT-python-min-2024-9287osv
- PSF-2024-12osv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (27)
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/python/cpython/issues/124651cnnvd
- https://github.com/python/cpython/pull/124712cnnvd
- https://mail.python.org/archives/list/security-announce@python.org/thread/RSPJ2B5JL22FG3TKUJ7D7DQ4N5JRRBZL/cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2024-9287cnnvd
- https://vigilance.fr/vulnerability/Python-Core-code-execution-via-Virtual-Environment-Unquoted-Paths-45445cnnvd
- https://www.oracle.com/security-alerts/cpujul2025.htmlcnnvd
- https://github.com/python/cpython/commit/633555735a023d3e4d92ba31da35b1205f9ecbd7enisa_euvd
- https://github.com/python/cpython/commit/8450b2482586857d689b6658f08de9c8179af7dbenisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan