Early Access — Mondoo Vulnerability Intelligence is currently in preview.
virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv's app_data and lock file operations to attacker-controlled locations. This issue has been patched in version 20.36.1.
20.10.0+ds-120.12.1+ds-120.13.0+ds-120.13.0+ds-220.14.0+ds-120.15.0+ds-120.16.3+ds-120.16.3+ds-220.16.3+ds-320.16.3+ds-4+35 more20.17.1+ds-120.19.0+ds-120.21.0+ds-120.23.0+ds-120.23.0+ds-220.24.1+ds-120.24.6+ds-120.24.6+ds-220.25.0+ds-120.25.0+ds-2+17 more20.31.2+ds-120.33.1+ds-120.34.0+ds-120.35.3+ds-120.35.4+ds-120.36.1+ds-120.36.1+ds-1Exploitability
AV:LAC:HPR:LUI:NScope
S:UImpact
C:LI:LA:LCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L