Ubuntu 24.10: USN-7116-1 high: Python code execution issue

ubuntu

November 19, 2024

Python could be made to run programs when activating virtual environments.

Summary

Python could be made to run programs when activating virtual environments.

Software Description:

- python3.12: An interactive high-level object-oriented language

- python3.10: An interactive high-level object-oriented language

- python3.8: An interactive high-level object-oriented language

Details:

It was discovered that Python incorrectly handled quoting path names when

using the venv module. A local attacker able to control virtual

environments could possibly use this issue to execute arbitrary code when

the virtual environment is activated.

Topics Covered

security advisory arbitrary code execution Ubuntu execution issue Python update python3 virtual environments

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.10
   python3.12                      3.12.7-1ubuntu1
   python3.12-minimal              3.12.7-1ubuntu1

Ubuntu 24.04 LTS
   python3.12                      3.12.3-1ubuntu0.3
   python3.12-minimal              3.12.3-1ubuntu0.3

Ubuntu 22.04 LTS
   python3.10                      3.10.12-1~22.04.7
   python3.10-minimal              3.10.12-1~22.04.7

Ubuntu 20.04 LTS
   python3.8                       3.8.10-0ubuntu1~20.04.13
   python3.8-minimal               3.8.10-0ubuntu1~20.04.13

In general, a standard system update will make all the necessary changes.