CVE-2024-9287

python

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2024-9287

Katalog CVE

CVSS 7.8 · High EPSS 0,65%

Kerentanan Unquoted Search Path or Element pada python. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.

Rincian

Terbit di NVD
22 Oktober 2024
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-428: Unquoted Search Path or Element
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
EPSS (30 hari)
0,65% peluang dieksploitasi; lebih tinggi dari 49,6% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
python python Semua versi sebelum 3.9.21
python python Versi 3.10.0 hingga sebelum 3.10.16
python python Versi 3.11.0 hingga sebelum 3.11.11
python python Versi 3.12.0 hingga sebelum 3.12.8
python python Versi 3.13.0 hingga sebelum 3.13.1
python python Versi 3.14.0 alpha1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.