PT-2014-4368 · Python · Python-Gnupg

Hanno Böck · Published 2014-10-25 · Updated 2018-11-06 · CVE-2014-1929

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions python-gnupg versions 0.3.5 through 0.3.6

Description The issue allows context-dependent attackers to have an unspecified impact via vectors related to option injection through positional arguments. It is also related to shell injection due to a failure to escape backslashes in the shell quote() function. This vulnerability exists because of an incomplete fix for a previous issue.

Recommendations For python-gnupg versions 0.3.5 and 0.3.6, consider disabling the use of positional arguments and the shell quote() function until a patch is available. Restrict access to sensitive areas where shell injection could be exploited to minimize the risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-1929

DSA-2946-1

GHSA-VCR5-XR9H-MVC5

PYSEC-2014-92

Affected Products

Python-Gnupg

References · 23

• https://osv.dev/vulnerability/GHSA-vcr5-xr9h-mvc5 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2014-92 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-1929 · Security Note
• https://osv.dev/vulnerability/CVE-2014-1929 · Vendor Advisory
• http://debian.org/security/2014/dsa-2946 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-1929 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-1929 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-1929 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-1929 · Security Note
• https://ubuntu.com/security/CVE-2014-1929 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/python-gnupg/PYSEC-2014-92.yaml · Note
• https://github.com/vsajip/python-gnupg · Note
• https://code.google.com/archive/p/python-gnupg/issues/98 · Note
• https://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/2014-June/028512.html · Note
• http://secunia.com/advisories/59031 · Note