CVE-2013-7323: python-gnupg Arbitrary Command Execution
Summary
CVE-2013-7323: python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors. Affects python-gnupg versions < 0.3.5. Fixed in 0.3.5. How to fix ↓
Also tracked for
- python-gnupg · Debian:11
The same CVE-2013-7323 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-gnupg is a Python module that provides a high-level interface to GnuPG, allowing users to encrypt, decrypt, sign, and verify data using the GnuPG encryption software. It is commonly used for secure communication and data protection. However, versions before 0.3.5 are vulnerable to arbitrary command execution.
Vulnerability Detail
The vulnerability in python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors. This means that an attacker can manipulate certain input vectors to inject malicious commands, which will be executed by the system when processed by python-gnupg. The impact of this vulnerability can be severe, as it allows an attacker to execute arbitrary commands with the privileges of the user running the python-gnupg module.
How To Fix
Latest published version: 0.5.7 as of 23 Oct 2026
pip install --upgrade "python-gnupg==0.5.7"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.5
This is the first release that contains the fix.
pip install --upgrade "python-gnupg==0.3.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that the python-gnupg module is not used in a context where untrusted input can be passed to it. Additionally, it is crucial to keep the software and its dependencies up to date to minimize the risk of exploitation.
Conclusion
The vulnerability in python-gnupg before version 0.3.5 allows for arbitrary command execution, which can have severe consequences. It is crucial to update the python-gnupg package to the latest version to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for python-gnupg →
FAQ
python-gnupg is a Python module that provides a high-level interface to GnuPG, allowing users to encrypt, decrypt, sign, and verify data using the GnuPG encryption software.
The vulnerability allows an attacker to execute arbitrary commands with the privileges of the user running the python-gnupg module.
To fix this vulnerability, upgrade python-gnupg to version 0.3.5 or later.
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that the python-gnupg module is not used in a context where untrusted input can be passed to it.
For more information about this vulnerability, refer to the official advisory: [link to advisory]
Related vulnerabilities
Recent vulnerabilities recorded for python-gnupg.
