Critical Vulnerability in python-gnupg: Shell Command Injection Risk
Summary
DEBIAN-CVE-2014-1928: The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated usin... Affects python-gnupg versions < 0.3.6-1. Fixed in 0.3.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-gnupg is a Python wrapper for GnuPG, allowing users to manage encryption and signing of data. It provides a simple interface for cryptographic operations, making it a popular choice for developers needing secure data handling. However, a vulnerability in version 0.3.5 compromises its security by failing to properly escape shell metacharacters, leading to potential command injection attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2014-1928, arises from the shell_quote function in python-gnupg version 0.3.5, which does not adequately escape characters. This oversight allows attackers to execute arbitrary code through shell metacharacters, particularly by using backslash characters to create multi-command sequences. This issue is distinct from CVE-2014-1927 and stems from an incomplete fix for CVE-2013-7323. The implications of this vulnerability are severe, as it can lead to unauthorized code execution in the context of the application using the library.
How To Fix
Minimum fixed version
0.3.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-gnupgTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the vulnerable version of python-gnupg (0.3.5) and consider implementing input validation to sanitize any user inputs that may be passed to shell commands. This can help mitigate the risk of command injection until the package is updated.
Conclusion
The vulnerability in python-gnupg poses a significant risk due to its potential for command injection. Users are strongly advised to update to the patched version to safeguard their applications. Implementing input validation can serve as a temporary measure to mitigate risks until the update is applied.
See every vulnerability recorded for python-gnupg →
FAQ
CVE-2014-1928 is a vulnerability in python-gnupg that allows attackers to execute arbitrary code due to improper escaping of shell metacharacters.
The vulnerability affects python-gnupg version 0.3.5 and earlier. Versions 0.3.6-1 and later contain the fix.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install anything.
Failing to address this vulnerability may allow attackers to execute arbitrary commands on the system, leading to data breaches, unauthorized access, or system compromise.
Yes, you can implement input validation to sanitize user inputs that may be passed to shell commands, reducing the risk of command injection until the package is updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-gnupg.
