DEBIAN-CVE-2026-113717

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-113717
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113717.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-113717
Upstream
Published
2026-10-22T22:47:38Z
Modified
2026-10-22T23:00:09Z
Summary
[none]
Details

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.get_pip_install_cmd() handles --seeder pip --download by calling get_wheel(download=False) and then allowing pip to consult the configured index, bypassing virtualenv's download_wheel() and verify_wheel_digest() path. When virtualenv's default-index PyPI digest comparison remains enabled, an index candidate matching the bundled package and version can therefore be selected without comparison to PyPI SHA-256 metadata. Explicit custom-index settings already opt out of that comparison and remain outside this verification-bypass claim; the demonstrated configuration used a non-PyPI index while leaving the index environment variables unset so the comparison policy remained active. This condition does not independently defeat TLS or establish control of the index response. This issue is fixed in version 21.14.9.

References

Affected packages

Debian:12 / python-virtualenv

Package

Name
python-virtualenv
Purl
pkg:deb/debian/python-virtualenv?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

20.*
20.17.1+ds-1
20.19.0+ds-1
20.21.0+ds-1
20.23.0+ds-1
20.23.0+ds-2
20.24.1+ds-1
20.24.6+ds-1
20.24.6+ds-2
20.25.0+ds-1
20.25.0+ds-2
20.25.1+ds-1
20.26.1+ds-1
20.26.2+ds-1
20.26.6+ds-1
20.27.0+ds-1
20.28.0+ds-1
20.29.1+ds-1
20.29.3+ds-1
20.30.0+ds-1
20.30.0+ds-2
20.30.0+ds-3
20.31.2+ds-1
20.33.1+ds-1
20.34.0+ds-1
20.35.3+ds-1
20.35.4+ds-1
20.36.1+ds-1
20.38.0+ds-1
21.*
21.2.0+ds-1
21.2.4+ds-1
21.3.1+ds-1
21.4.1+ds-1
21.5.1+ds-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113717.json"

Debian:13 / python-virtualenv

Package

Name
python-virtualenv
Purl
pkg:deb/debian/python-virtualenv?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

20.*
20.31.2+ds-1
20.31.2+ds-1+deb13u1
20.33.1+ds-1
20.34.0+ds-1
20.35.3+ds-1
20.35.4+ds-1
20.36.1+ds-1
20.38.0+ds-1
21.*
21.2.0+ds-1
21.2.4+ds-1
21.3.1+ds-1
21.4.1+ds-1
21.5.1+ds-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113717.json"

Debian:14 / python-virtualenv

Package

Name
python-virtualenv
Purl
pkg:deb/debian/python-virtualenv?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

20.*
20.31.2+ds-1
20.33.1+ds-1
20.34.0+ds-1
20.35.3+ds-1
20.35.4+ds-1
20.36.1+ds-1
20.38.0+ds-1
21.*
21.2.0+ds-1
21.2.4+ds-1
21.3.1+ds-1
21.4.1+ds-1
21.5.1+ds-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113717.json"