Is CVE-2011-4617 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2011-4617 being exploited in the wild.

How severe is CVE-2011-4617?

Low severity, with a CVSS score of 3.1, published 31 December 2011.

Which products and versions are affected?

virtualenv (PyPI) ECOSYSTEM:introduced=0,fixed=1.5.

Is there a fix for CVE-2011-4617?

Yes. virtualenv (PyPI): upgrade to 1.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2011-4617 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2011-4617?

Check whether you run virtualenv (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2011-4617: PYSEC-2011-23 - virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/.

CVE-2011-4617 · Severity: low · CVSS 3.1 · Published 2011-12-31

Virtualenv is a Python tool used to create isolated virtual environments for running Python applications. A local attacker with access to a system could exploit a symlink vulnerability in the temporary directory to overwrite arbitrary files, potentially compromising system integrity or causing unauthorized modifications to files they should not have access to.

Technologies: virtualenv (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2011-4617 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2011-4617 being exploited in the wild.
How severe is CVE-2011-4617?: Low severity, with a CVSS score of 3.1, published 31 December 2011.
Which products and versions are affected?: virtualenv (PyPI) ECOSYSTEM:introduced=0,fixed=1.5.
Is there a fix for CVE-2011-4617?: Yes. virtualenv (PyPI): upgrade to 1.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2011-4617 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2011-4617?: Check whether you run virtualenv (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

virtualenv (PyPI): upgrade to 1.5 or later
```
pip install "virtualenv>=1.5"
```

Technical details

The vulnerability is a classic symlink attack (CWE-59) in virtualenv.py where the tool creates temporary files in /tmp without properly validating that the file path is not a symlink to another file. An attacker can create a symlink at the predictable location where virtualenv expects to write its temporary file, causing virtualenv to overwrite an arbitrary file the attacker selects. This requires local filesystem access but no authentication or special privileges. The vulnerability was fixed in virtualenv 1.5 by switching to use Python's tempfile module, which creates temporary files securely in a protected temporary directory.

Affected products

pypa virtualenv before 1.5

Identifiers

CVE-2011-4617
GHSA-3jhc-wjqf-5f2c
PYSEC-2011-23

Timeline

2011-12-31: disclosed: NVD published date
2011: patched: Fixed in virtualenv 1.5 by using tempfile module instead of /tmp
2022-05-17: advisory: GitHub advisory published

References

https://github.com/pypa/virtualenv/commit/68075ad9ededf7df2c46d385f836c13b729de2ca

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.