PT-2020-12533 · Python · Autoswitch Python Virtualenv

Michael Aquilina · Published 2020-05-13 · Updated 2021-11-04 · CVE-2020-11073

Positive Technologies (AI Summary)

CVSS v3.1

7.9

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Autoswitch Python Virtualenv versions prior to 1.16.0

Description A user who enters a directory with a malicious .venv file could run arbitrary code without any user interaction.

Recommendations For versions prior to 1.16.0, update to version 1.16.0 to resolve the issue. As a temporary workaround, consider avoiding directories that may contain malicious .venv files until the update is applied.

Exploit

Fix

Command Injection

Path traversal

Weakness Enumeration

CWE-77

CWE-22

Related Identifiers

CVE-2020-11073

GHSA-H8WM-CQQ6-957Q

Affected Products

Autoswitch Python Virtualenv

References · 7

• 🔥 https://github.com/MichaelAquilina/zsh-autoswitch-virtualenv/issues/122 · Exploit
• https://github.com/MichaelAquilina/zsh-autoswitch-virtualenv/commit/30c77db7c83eca2bc5f6134fccbdc117b49a6a05 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-11073 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11073 · Vendor Advisory
• https://github.com/MichaelAquilina/zsh-autoswitch-virtualenv/security/advisories/GHSA-h8wm-cqq6-957q · Note
• https://github.com/MichaelAquilina/zsh-autoswitch-virtualenv/pull/123 · Note
• https://t.me/cvenotify/3755 · Telegram Post