Debian Python-Virtualenv vulnerabilities

CVE-2024-53899 [HIGH] CVE-2024-53899: python-virtualenv - virtualenv before 20.26.6 allows command injection through the activation script... virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 20.26.6+ds-1) sid: resolved (fixed in 20.26.6+ds-1) trixie: resolved (f

CVE-2013-1629 [MEDIUM] CVE-2013-1629: python-pip - pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does... pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation. Scope: local bookworm: resolved (fixed in 1.3.1-1) bullseye: resolved (fixed in 1.3.1-1) forky: resolved (fixed in

CVE-2026-22702 [MEDIUM] CVE-2026-22702: python-virtualenv - virtualenv is a tool for creating isolated virtual python environments. Prior to... virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creati

CVE-2011-4617 [LOW] CVE-2011-4617: python-virtualenv - virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary... virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/. Scope: local bookworm: resolved (fixed in 1.6-1) bullseye: resolved (fixed in 1.6-1) forky: resolved (fixed in 1.6-1) sid: resolved (fixed in 1.6-1) trixie: resolved (fixed in 1.6-1)