gh-124651: Quote template strings in `venv` activation scripts by y5c4l3 · Pull Request #124712 · python/cpython

y5c4l3 · 2024-09-27T21:15:02Z

This patch properly quotes template strings in venv activation scripts. This mitigates potential command injection.

Issue: [CVE-2024-9287] venv activation scripts do not quote strings properly #124651

bedevere-bot · 2024-09-30T11:20:55Z

🤖 New build scheduled with the buildbot fleet by @vsajip for commit 3034419 🤖

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.

This patch properly quotes template strings in `venv` activation scripts. This mitigates potential command injection. Signed-off-by: y5c4l3 <y5c4l3@proton.me>

y5c4l3 · 2024-10-01T13:29:33Z

buildbot/AMD64 FreeBSD failed because bash was not found. I will add a test for tcsh / csh and skip the original test if bash is not present.

======================================================================
ERROR: test_special_chars (test.test_venv.BasicTest.test_special_chars)
Test that the template strings are quoted properly
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/buildbot/buildarea/pull_request.ware-freebsd/build/Lib/test/test_venv.py", line 515, in test_special_chars
    out, err = check_output([bash, test_script])
               ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^
  File "/buildbot/buildarea/pull_request.ware-freebsd/build/Lib/test/test_venv.py", line 50, in check_output
    p = subprocess.Popen(cmd,
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,
        env={**os.environ, "PYTHONHOME": ""})
  File "/buildbot/buildarea/pull_request.ware-freebsd/build/Lib/subprocess.py", line 1035, in __init__
    self._execute_child(args, executable, preexec_fn, close_fds,
    ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                        pass_fds, cwd, env,
                        ^^^^^^^^^^^^^^^^^^^
    ...<5 lines>...
                        gid, gids, uid, umask,
                        ^^^^^^^^^^^^^^^^^^^^^^
                        start_new_session, process_group)
                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/buildbot/buildarea/pull_request.ware-freebsd/build/Lib/subprocess.py", line 1885, in _execute_child
    executable = os.fsencode(executable)
  File "/buildbot/buildarea/pull_request.ware-freebsd/build/Lib/os.py", line 852, in fsencode
    filename = fspath(filename)  # Does type-checking of `filename`.
TypeError: expected str, bytes or os.PathLike object, not NoneType

----------------------------------------------------------------------
Ran 36 tests in 7.578s

bedevere-bot · 2024-10-09T18:27:03Z

🤖 New build scheduled with the buildbot fleet by @vsajip for commit b6a3bbd 🤖

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.

y5c4l3 · 2024-10-10T12:21:48Z

@vsajip Some tests were still failing but none of them is related to this PR I guess.

y5c4l3 · 2024-10-21T13:10:18Z

@vsajip Summary of the failing tests are posted here. Since they all appeared repeatedly before or after this build, I think this PR is good to go... no?

AMD64 Arch Linux TraceRefs PR/1443

FAIL: test_audit_subinterpreter (test.test_embed.AuditingTests.test_audit_subinterpreter)

iOS ARM64 Simulator PR/136

FAIL: test_alt_digits_nl_langinfo (test.test__locale._LocaleTests.test_alt_digits_nl_langinfo) (locale='ja_JP')

x86 Debian Installed with X PR/27
x86 Debian Non-Debug with X PR/27

make: *** [Makefile:1534: Modules/_hacl/Hacl_Hash_Blake2s_Simd128.o] Error 1
make: *** Waiting for unfinished jobs....

miss-islington-app · 2024-10-21T20:48:25Z

Thanks @y5c4l3 for the PR, and @vsajip for merging it 🌮🎉.. I'm working now to backport this PR to: 3.12.
🐍🍒⛏🤖

miss-islington-app · 2024-10-21T20:48:25Z

Thanks @y5c4l3 for the PR, and @vsajip for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

miss-islington-app · 2024-10-21T20:48:29Z

Sorry, @y5c4l3 and @vsajip, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker d48cc82ed25e26b02eb97c6263d95dcaa1e9111b 3.12

…ythonGH-124712) This patch properly quotes template strings in `venv` activation scripts. This mitigates potential command injection. (cherry picked from commit d48cc82) Co-authored-by: Y5 <124019959+y5c4l3@users.noreply.github.com>

bedevere-app · 2024-10-21T20:48:55Z

GH-125813 is a backport of this pull request to the 3.13 branch.

…GH-124712) (GH-125813) (cherry picked from commit d48cc82)

…ythonGH-124712) This patch properly quotes template strings in `venv` activation scripts. This mitigates potential command injection. (cherry picked from commit d48cc82)

bedevere-app · 2024-10-30T15:00:10Z

GH-126185 is a backport of this pull request to the 3.12 branch.

…GH-124712) (GH-126185) (cherry picked from commit d48cc82)

…GH-124712) (GH-126185) (#126269)

…GH-124712) (GH-126185) (GH-126269) (GH-126300) (cherry picked from commit ae961ae)

…H-124712) (GH-126185) (GH-126269) (GH-126301) (cherry picked from commit ae961ae)

Taken from python/cpython#126185 which is a 3.12 backport of python/cpython#124712 Signed-off-by: Saul Paredes <saulparedes@microsoft.com>

mcepl · 2024-12-02T08:01:14Z

My backport of fix for Python 3.6 is at openSUSE-Python@4f2496b.

Taken from python/cpython#126185 which is a 3.12 backport of python/cpython#124712 Signed-off-by: Saul Paredes <saulparedes@microsoft.com>

…ythonGH-124712) This patch properly quotes template strings in `venv` activation scripts. This mitigates potential command injection.

… activation scripts (pythonGH-124712) (pythonGH-126185) (pythonGH-126269) (pythonGH-126301) (cherry picked from commit ae961ae)

…ripts (pythonGH-124712) (pythonGH-126185) (pythonGH-126269) (pythonGH-126301) (cherry picked from commit ae961ae)

y5c4l3 requested a review from vsajip as a code owner September 27, 2024 21:15

bedevere-app bot added the awaiting review label Sep 27, 2024

bedevere-app bot mentioned this pull request Sep 27, 2024

[CVE-2024-9287] venv activation scripts do not quote strings properly #124651

Closed

vsajip added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Sep 30, 2024

bedevere-bot removed the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Sep 30, 2024

Quote template strings in venv activation scripts

b6a3bbd

This patch properly quotes template strings in `venv` activation scripts. This mitigates potential command injection. Signed-off-by: y5c4l3 <y5c4l3@proton.me>

y5c4l3 force-pushed the venv-quote branch from 3034419 to b6a3bbd Compare October 1, 2024 13:30

vsajip added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Oct 9, 2024

bedevere-bot removed the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Oct 9, 2024

vsajip approved these changes Oct 21, 2024

View reviewed changes

bedevere-app bot added awaiting merge and removed awaiting review labels Oct 21, 2024

vsajip merged commit d48cc82 into python:main Oct 21, 2024

bedevere-app bot removed the awaiting merge label Oct 21, 2024

vsajip added needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes labels Oct 21, 2024

miss-islington-app bot assigned vsajip Oct 21, 2024

bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Oct 21, 2024

vsajip pushed a commit that referenced this pull request Oct 22, 2024

[3.13] gh-124651: Quote template strings in venv activation scripts (…

e52095a

…GH-124712) (GH-125813) (cherry picked from commit d48cc82)

bedevere-app bot removed the needs backport to 3.12 only security fixes label Oct 30, 2024

vsajip pushed a commit that referenced this pull request Oct 31, 2024

[3.12] gh-124651: Quote template strings in venv activation scripts (…

8450b24

…GH-124712) (GH-126185) (cherry picked from commit d48cc82)

This comment was marked as off-topic.

Sign in to view

This comment was marked as outdated.

Sign in to view

pablogsal pushed a commit that referenced this pull request Nov 1, 2024

[3.11] gh-124651: Quote template strings in venv activation scripts (…

ae961ae

…GH-124712) (GH-126185) (#126269)

ambv pushed a commit that referenced this pull request Nov 4, 2024

[3.10] gh-124651: Quote template strings in venv activation scripts (…

9286ab3

…GH-124712) (GH-126185) (GH-126269) (GH-126300) (cherry picked from commit ae961ae)

ambv pushed a commit that referenced this pull request Nov 4, 2024

[3.9] gh-124651: Quote template strings in venv activation scripts (G…

6335557

…H-124712) (GH-126185) (GH-126269) (GH-126301) (cherry picked from commit ae961ae)

Redent0r added a commit to Redent0r/CBL-Mariner that referenced this pull request Nov 6, 2024

python3: patch CVE-2024-9287

14fc52f

Taken from python/cpython#126185 which is a 3.12 backport of python/cpython#124712 Signed-off-by: Saul Paredes <saulparedes@microsoft.com>

Redent0r mentioned this pull request Nov 6, 2024

python3: patch CVE-2024-9287 microsoft/azurelinux#10959

Closed

12 tasks

Redent0r added a commit to Redent0r/CBL-Mariner that referenced this pull request Nov 6, 2024

python3: patch CVE-2024-9287

796d7cc

Taken from python/cpython#126185 which is a 3.12 backport of python/cpython#124712 Signed-off-by: Saul Paredes <saulparedes@microsoft.com>

Redent0r added a commit to Redent0r/CBL-Mariner that referenced this pull request Nov 7, 2024

python3: patch CVE-2024-9287

f1f5295

Taken from python/cpython#126185 which is a 3.12 backport of python/cpython#124712 Signed-off-by: Saul Paredes <saulparedes@microsoft.com>

Redent0r added a commit to Redent0r/CBL-Mariner that referenced this pull request Nov 7, 2024

python3: patch CVE-2024-9287

71588af

Taken from python/cpython#126185 which is a 3.12 backport of python/cpython#124712 Signed-off-by: Saul Paredes <saulparedes@microsoft.com>

Redent0r added a commit to Redent0r/CBL-Mariner that referenced this pull request Nov 7, 2024

python3: patch CVE-2024-9287

d695dd3

Taken from python/cpython#126185 which is a 3.12 backport of python/cpython#124712 Signed-off-by: Saul Paredes <saulparedes@microsoft.com>

Redent0r added a commit to Redent0r/CBL-Mariner that referenced this pull request Nov 26, 2024

python3: patch CVE-2024-9287

a09d45d

Taken from python/cpython#126185 which is a 3.12 backport of python/cpython#124712 Signed-off-by: Saul Paredes <saulparedes@microsoft.com>

Redent0r added a commit to Redent0r/CBL-Mariner that referenced this pull request Dec 18, 2024

python3: patch CVE-2024-9287

e30a76b

Taken from python/cpython#126185 which is a 3.12 backport of python/cpython#124712 Signed-off-by: Saul Paredes <saulparedes@microsoft.com>

Redent0r added a commit to Redent0r/CBL-Mariner that referenced this pull request Dec 18, 2024

python3: patch CVE-2024-9287

db00eb6

Taken from python/cpython#126185 which is a 3.12 backport of python/cpython#124712 Signed-off-by: Saul Paredes <saulparedes@microsoft.com>

rickprice mentioned this pull request Mar 7, 2025

Be-5264 CVE 2024 9287 python 3 7 ActiveState/cpython#71

Merged

rickprice mentioned this pull request Mar 7, 2025

BE-5255 CVE-2024-9287 [3.9] gh-124651: Quote template strings in venv activ… ActiveState/cpython#72

Merged

gentoo-bot pushed a commit to gentoo/cpython that referenced this pull request Apr 9, 2025

[3.9] pythongh-124651: Quote template strings in venv activation sc…

5b9bdc1

…ripts (pythonGH-124712) (pythonGH-126185) (pythonGH-126269) (pythonGH-126301) (cherry picked from commit ae961ae)

sajjaphani mentioned this pull request May 19, 2025

[Security] Vulnerability found in Security vulnerability CVE-2024-9287 in package python habitat-sh/foundational-packages#66

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

gh-124651: Quote template strings in `venv` activation scripts#124712

gh-124651: Quote template strings in `venv` activation scripts#124712
vsajip merged 1 commit intopython:mainfrom
y5c4l3:venv-quote

y5c4l3 commented Sep 27, 2024 •

edited by bedevere-app bot

Loading

Uh oh!

bedevere-bot commented Sep 30, 2024

Uh oh!

y5c4l3 commented Oct 1, 2024 •

edited

Loading

Uh oh!

bedevere-bot commented Oct 9, 2024

Uh oh!

y5c4l3 commented Oct 10, 2024

Uh oh!

y5c4l3 commented Oct 21, 2024

Uh oh!

miss-islington-app bot commented Oct 21, 2024

Uh oh!

miss-islington-app bot commented Oct 21, 2024

Uh oh!

miss-islington-app bot commented Oct 21, 2024

Uh oh!

bedevere-app bot commented Oct 21, 2024

Uh oh!

bedevere-app bot commented Oct 30, 2024

Uh oh!

This comment was marked as off-topic.

This comment was marked as outdated.

mcepl commented Dec 2, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

y5c4l3 commented Sep 27, 2024 • edited by bedevere-app bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bedevere-bot commented Sep 30, 2024

Uh oh!

y5c4l3 commented Oct 1, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bedevere-bot commented Oct 9, 2024

Uh oh!

y5c4l3 commented Oct 10, 2024

Uh oh!

y5c4l3 commented Oct 21, 2024

Uh oh!

miss-islington-app bot commented Oct 21, 2024

Uh oh!

miss-islington-app bot commented Oct 21, 2024

Uh oh!

miss-islington-app bot commented Oct 21, 2024

Uh oh!

bedevere-app bot commented Oct 21, 2024

Uh oh!

bedevere-app bot commented Oct 30, 2024

Uh oh!

This comment was marked as off-topic.

This comment was marked as outdated.

mcepl commented Dec 2, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

y5c4l3 commented Sep 27, 2024 •

edited by bedevere-app bot

Loading

y5c4l3 commented Oct 1, 2024 •

edited

Loading