Executive brief
Virtualenv is a Python tool used to create isolated virtual environments for running Python applications. A local attacker with access to a system could exploit a symlink vulnerability in the temporary directory to overwrite arbitrary files, potentially compromising system integrity or causing unauthorized modifications to files they should not have access to.
Technical details
The vulnerability is a classic symlink attack (CWE-59) in virtualenv.py where the tool creates temporary files in /tmp without properly validating that the file path is not a symlink to another file. An attacker can create a symlink at the predictable location where virtualenv expects to write its temporary file, causing virtualenv to overwrite an arbitrary file the attacker selects. This requires local filesystem access but no authentication or special privileges. The vulnerability was fixed in virtualenv 1.5 by switching to use Python's tempfile module, which creates temporary files securely in a protected temporary directory.
Affected products
- pypa virtualenv before 1.5
Timeline
- 2011-12-31: disclosed: NVD published date
- 2011: patched: Fixed in virtualenv 1.5 by using tempfile module instead of /tmp
- 2022-05-17: advisory: GitHub advisory published