Source: python-virtualenv Version: 21.5.1+ds-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for python-virtualenv. CVE-2026-102925[0]: | virtualenv is a tool for creating isolated virtual python | environments. Prior to 21.7.13, the generated activate (bash and | zsh) and activate.fish scripts place values already escaped by | shlex.quote inside an additional quoted context. In the bash and zsh | script, a crafted virtual environment path reaches __VIRTUAL_ENV__ | when a relocated environment's recorded directory is absent; in the | fish script, crafted Tcl or Tk library paths reach __TCL_LIBRARY__ | or __TK_LIBRARY__. The surplus quotes can terminate the data-only | quoted run and leave shell metacharacters parsed as commands when a | user sources the activation script, allowing code execution with | that user's privileges. This issue is fixed in version 21.7.13. CVE-2026-102930[1]: | virtualenv is a tool for creating isolated virtual python | environments. Prior to 21.7.12, download_wheel() accepts pip and | setuptools seed wheels fetched for periodic updates or the | --download option without checking their bytes against an | authoritative digest equivalent to the embedded wheels' | BUNDLE_SHA256 verification. A compromised index, stale mirror, or | intercepted TLS connection can substitute a different wheel under | the requested distribution, version, and filename, after which | virtualenv caches and seeds the attacker-controlled wheel into | subsequently created environments. The verification applies to the | default PyPI path and is intentionally skipped when PIP_INDEX_URL, | PIP_EXTRA_INDEX_URL, or PIP_INDEX configures a custom index that may | legitimately publish rebuilt wheels. This issue is fixed in version | 21.7.12. CVE-2026-102938[2]: | virtualenv is a tool for creating isolated virtual python | environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt | values verbatim to the line-oriented pyvenv.cfg format while | PyEnvCfg._read_values() parses the file with str.splitlines() and | accepts the last value for duplicate keys. An attacker who | influences --prompt, VIRTUALENV_PROMPT, or configuration input can | insert a recognized line boundary and additional keys, including | home, causing consumers to use an attacker-selected base interpreter | or corrupted environment metadata. The security impact requires | prompt input from outside the operator's trust boundary; directly | supplied prompt content primarily corrupts the operator's own | environment. This issue is fixed in version 21.7.11. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-102925 https://www.cve.org/CVERecord?id=CVE-2026-102925 [1] https://security-tracker.debian.org/tracker/CVE-2026-102930 https://www.cve.org/CVERecord?id=CVE-2026-102930 [2] https://security-tracker.debian.org/tracker/CVE-2026-102938 https://www.cve.org/CVERecord?id=CVE-2026-102938 Regards, Salvatore
