[Git][security-tracker-team/security-tracker][master] Add new virtualenv issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
52927f9c by Salvatore Bonaccorso at 2026-10-01T07:18:46+02:00
Add new virtualenv issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1223,13 +1223,26 @@ CVE-2026-103041 (LightLLM through 1.2.0 multimodal deployments expose an unauthe
 CVE-2026-103040 (LightLLM through 1.2.0 contains a remote code execution vulnerability  ...)
 	NOT-FOR-US: LightLLM
 CVE-2026-102938 (virtualenv is a tool for creating isolated virtual python environments ...)
-	TODO: check
+	- python-virtualenv <unfixed>
+	NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-9h9j-4vrj-gf7g
+	NOTE: https://github.com/pypa/virtualenv/pull/3247
+	NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/a30f995461043acb6cacbf3a890951563ccf7140 (21.7.11)
 CVE-2026-102937 (virtualenv is a tool for creating isolated virtual python environments ...)
-	TODO: check
+	- python-virtualenv <unfixed> (unimportant)
+	NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-x78j-v8h9-3j2q
+	NOTE: https://github.com/pypa/virtualenv/pull/3250
+	NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/d721ff140ce4afdc2a9b76751e4584e25d9fbea6 (21.7.12)
+	NOTE: Only impact activate.bat when running on Windows
 CVE-2026-102930 (virtualenv is a tool for creating isolated virtual python environments ...)
-	TODO: check
+	- python-virtualenv <unfixed>
+	NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-94p9-xgh2-xp45
+	NOTE: https://github.com/pypa/virtualenv/pull/3251
+	NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/a01ed3e2f239d6ab1fce62c5c7664ccf268fff6d (21.7.12)
 CVE-2026-102925 (virtualenv is a tool for creating isolated virtual python environments ...)
-	TODO: check
+	- python-virtualenv <unfixed>
+	NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-p58f-9548-mpm2
+	NOTE: https://github.com/pypa/virtualenv/pull/3252
+	NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6 (21.7.13)
 CVE-2026-102913 (A security flaw has been discovered in SourceCodester Car Driving Scho ...)
 	NOT-FOR-US: SourceCodester
 CVE-2026-102912 (A vulnerability was identified in SourceCodester Online Leave Manageme ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/52927f9ce591b27d9dd0ed8477233e07f7174ccd

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/52927f9ce591b27d9dd0ed8477233e07f7174ccd
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261001/d4762740/attachment.htm>