CVE-2014-1927: High severity vulnerability in python-gnupg
Summary
CVE-2014-1927: python-gnupg's shell_quote function does not properly quote strings. Affects python-gnupg versions >= 0.3.5, < 0.3.6. Fixed in 0.3.6. How to fix ↓
Also tracked for
- python-gnupg · Debian:11
The same CVE-2014-1927 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-gnupg is a Python wrapper for the GNU Privacy Guard (GPG). It provides a high-level interface for interacting with GPG, allowing users to encrypt, decrypt, sign, and verify data. The package is commonly used in Python applications that require secure communication and data protection. However, python-gnupg version 0.3.5 is vulnerable to a high severity issue that can be exploited by attackers to execute arbitrary code.
Vulnerability Detail
The vulnerability in python-gnupg version 0.3.5 lies in the shell_quote function, which is responsible for quoting strings to prevent shell metacharacters from being interpreted as commands. However, this function does not properly quote strings, allowing context-dependent attackers to execute arbitrary code by injecting shell metacharacters through unspecified vectors. This can be demonstrated using command-substitution sequences like "$(". It is important to note that this vulnerability is different from CVE-2014-1928 and exists due to an incomplete fix for CVE-2013-7323. The impact of this vulnerability can be severe, as it enables attackers to execute arbitrary code within the context of the application, potentially leading to unauthorized access, data breaches, or system compromise.
How To Fix
Minimum fixed version
0.3.6
This is the first release that contains the fix.
pip install --upgrade "python-gnupg==0.3.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a patched version of python-gnupg.
Conclusion
The python-gnupg package version 0.3.5 is vulnerable to a high severity issue that allows attackers to execute arbitrary code. To mitigate this vulnerability, it is crucial to upgrade to python-gnupg version 0.3.6 or later. This fix addresses the incomplete quoting issue in the shell_quote function, preventing the execution of arbitrary code. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-gnupg →
FAQ
python-gnupg is a Python wrapper for the GNU Privacy Guard (GPG), providing a high-level interface for interacting with GPG functionalities.
The vulnerability allows context-dependent attackers to execute arbitrary code within the application's context, potentially leading to unauthorized access, data breaches, or system compromise.
No, there is no known workaround for this vulnerability. It is crucial to upgrade to a patched version of python-gnupg.
To fix this vulnerability, upgrade python-gnupg to version 0.3.6 or later using the command 'pip install --upgrade python-gnupg'.
No, this vulnerability is different from CVE-2014-1928. It exists due to an incomplete fix for CVE-2013-7323.
Related vulnerabilities
Recent vulnerabilities recorded for python-gnupg.
