Arbitrary Code Execution Vulnerability in python-gnupg - CVE-2014-1928
Summary
CVE-2014-1928: The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated usin... Affects python-gnupg versions < 0.3.6-1. Fixed in 0.3.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-gnupg is a Python wrapper for GnuPG, allowing developers to integrate GnuPG functionalities into their Python applications. It provides features for encryption, decryption, and signing of data. However, an issue in the shell_quote function of version 0.3.5 has been identified, which fails to properly escape shell metacharacters, making it susceptible to arbitrary code execution.
Vulnerability Detail
The vulnerability, identified as CVE-2014-1928, arises from the shell_quote function in python-gnupg version 0.3.5. It does not adequately escape characters, allowing attackers to execute arbitrary code through shell metacharacters. This can be exploited by injecting commands using backslash characters to create multi-command sequences. The vulnerability is a result of an incomplete fix for a previous issue (CVE-2013-7323), and its ramifications include potential unauthorized access and control over the affected systems.
How To Fix
Minimum fixed version
0.3.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-gnupgTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the vulnerable version (0.3.5) of python-gnupg. If upgrading is not immediately possible, consider implementing input validation to sanitize user inputs and prevent the injection of shell metacharacters.
Conclusion
CVE-2014-1928 is a significant vulnerability in python-gnupg that can lead to arbitrary code execution due to improper handling of shell metacharacters. Users are strongly advised to upgrade to the latest version to mitigate risks associated with this vulnerability.
See every vulnerability recorded for python-gnupg →
FAQ
CVE-2014-1928 is a vulnerability in python-gnupg that allows arbitrary code execution due to improper escaping of shell metacharacters.
Versions prior to 0.3.6-1 are affected, specifically version 0.3.5.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The risks include unauthorized access to systems, execution of arbitrary commands, and potential data breaches.
Yes, upgrading to python-gnupg version 0.3.6-1 or later resolves the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for python-gnupg.
