Amazon Linux 2023 Security Advisory: ALAS2023-2026-1428
Advisory Released Date: 2026-02-18
Advisory Updated Date: 2026-02-18
Severity:
Medium
Issue Overview:
virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv's app_data and lock file operations to attacker-controlled locations. This issue has been patched in version 20.36.1. (CVE-2026-22702)
Affected Packages:
python3.13-virtualenv
Issue Correction:
Run dnf update python3.13-virtualenv --releasever 2023.10.20260216 or dnf update --advisory ALAS2023-2026-1428 --releasever 2023.10.20260216 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
New Packages:
noarch:
python3.13-virtualenv-20.21.1-1.amzn2023.0.2.noarch
src:
python3.13-virtualenv-20.21.1-1.amzn2023.0.2.src