CVE-2014-1928: python-gnupg - Arbitrary Code Execution Vulnerability
Summary
CVE-2014-1928: python-gnupg's shell_quote function does not properly escape characters. Affects python-gnupg versions >= 0.3.5, < 0.3.6. Fixed in 0.3.6. How to fix ↓
Also tracked for
- python-gnupg · Debian:11
The same CVE-2014-1928 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-gnupg is a Python module that provides a high-level interface to GnuPG. It allows users to encrypt, decrypt, sign, and verify files or messages using GnuPG. The vulnerability affects version 0.3.5 of python-gnupg. This package is commonly used in Python projects that require GnuPG functionality.
Vulnerability Detail
The vulnerability in python-gnupg 0.3.5 is due to the shell_quote function not properly escaping characters. This allows context-dependent attackers to execute arbitrary code by using shell metacharacters in unspecified vectors. An attacker can exploit this vulnerability by using backslash characters to form multi-command sequences. It is important to note that this vulnerability is different from CVE-2014-1927 and exists due to an incomplete fix for CVE-2013-7323. The severity of this vulnerability is considered moderate.
How To Fix
Minimum fixed version
0.3.6
This is the first release that contains the fix.
pip install --upgrade "python-gnupg==0.3.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of python-gnupg as soon as possible.
Conclusion
The vulnerability in python-gnupg 0.3.5 allows context-dependent attackers to execute arbitrary code. To mitigate this issue, users should upgrade to version 0.3.6 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-gnupg →
FAQ
python-gnupg is a Python module that provides a high-level interface to GnuPG. It allows users to encrypt, decrypt, sign, and verify files or messages using GnuPG.
The vulnerability allows context-dependent attackers to execute arbitrary code by using shell metacharacters. This can lead to unauthorized access, data manipulation, or other malicious activities.
Yes, the vulnerability can be fixed by upgrading python-gnupg to version 0.3.6 or later.
No, there are no known workarounds for this vulnerability. It is recommended to upgrade to the fixed version of python-gnupg.
No, this vulnerability is different from CVE-2014-1927. It exists due to an incomplete fix for CVE-2013-7323.
Related vulnerabilities
Recent vulnerabilities recorded for python-gnupg.
