PT-2018-2305 · Python+3 · Python+3
Abergmann
·
Publicado
2018-09-18
·
Atualizado
2025-09-29
·
CVE-2018-1000802
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Python (CPython) version 2.7
Description
The issue is related to a command injection vulnerability in the
shutil module, specifically in the make archive function. This vulnerability can be exploited by passing unfiltered user input to the function, potentially resulting in denial of service or information gain via injection of arbitrary files on the system or entire drive. The vulnerability appears to be exploitable via the passage of unfiltered user input to the function.Recommendations
For Python (CPython) version 2.7, consider updating to a version where the issue has been fixed, as indicated by the commit add531a1e55b0a739b0f42582f1c9747e5649ace. As a temporary workaround, consider filtering user input before passing it to the
make archive function in the shutil module to minimize the risk of exploitation.Exploit
Correção
DoS
Command Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Python
Suse
Ubuntu