CVE-2014-1929: python-gnupg - Option Injection through Positional Arguments
Summary
CVE-2014-1929: python-gnupg vulnerable to shell injection. Affects python-gnupg versions >= 0.3.5, < 0.3.7. Fixed in 0.3.7. How to fix ↓
Also tracked for
- python-gnupg · Debian:11
The same CVE-2014-1929 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
python-gnupg is a Python module that provides a high-level interface to GnuPG, a widely used encryption and decryption tool. It allows developers to interact with GnuPG functionality programmatically. The vulnerability affects versions 0.3.5 and 0.3.6 of python-gnupg. The package is susceptible to option injection through positional arguments, which can be exploited by context-dependent attackers. This vulnerability is a result of an incomplete fix for CVE-2013-7323.
Vulnerability Detail
The vulnerability in python-gnupg allows attackers to have an unspecified impact by injecting options through positional arguments. This can lead to various security issues depending on the context in which the module is used. The exact impact is not specified, but it can potentially result in unauthorized access, data leakage, or other malicious activities. The vulnerability was assigned a moderate severity rating.
How To Fix
Minimum fixed version
0.3.7
This is the first release that contains the fix.
pip install --upgrade "python-gnupg==0.3.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed version of python-gnupg.
Conclusion
The vulnerability in python-gnupg allows for option injection through positional arguments, potentially leading to unauthorized access or data leakage. It is recommended to upgrade to version 0.3.7 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for python-gnupg →
FAQ
python-gnupg is a Python module that provides a high-level interface to GnuPG, allowing developers to interact with GnuPG functionality programmatically.
The exact impact of this vulnerability is unspecified, but it can potentially lead to unauthorized access, data leakage, or other malicious activities.
To fix this vulnerability, it is recommended to upgrade python-gnupg to version 0.3.7 or later.
There is no specific workaround mentioned for this vulnerability. Upgrading to the fixed version is the recommended solution.
For more information about this vulnerability, you can refer to the CVE-2014-1929 entry or the GitHub advisory database.
Related vulnerabilities
Recent vulnerabilities recorded for python-gnupg.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
