CVE-2014-1927: python-gnupg Shell Command Injection
Summary
CVE-2014-1927: The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$... Affects python-gnupg versions >= 0.3.5, < 0.3.6. Fixed in 0.3.6. How to fix ↓
Also tracked for
- python-gnupg · Debian:11
The same CVE-2014-1927 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
python-gnupg is a Python module that provides a high-level interface to GnuPG, allowing users to encrypt, decrypt, sign, and verify files and messages. It is commonly used in Python applications that require cryptographic functionality. However, the python-gnupg package prior to version 0.3.6 is vulnerable to a shell command injection attack.
Vulnerability Detail
The vulnerability (CVE-2014-1927) in python-gnupg arises from the improper quoting of strings in the shell_quote function. This flaw enables context-dependent attackers to execute arbitrary code by injecting shell metacharacters through unspecified vectors. An attacker can exploit this vulnerability using command-substitution sequences like "$(". It is important to note that this vulnerability is distinct from CVE-2014-1928 and exists due to an incomplete fix for CVE-2013-7323.
How To Fix
Minimum fixed version
0.3.6
This is the first release that contains the fix.
pip install --upgrade "python-gnupg==0.3.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix mentioned above by upgrading to python-gnupg version 0.3.6 or later.
Conclusion
The python-gnupg package prior to version 0.3.6 is vulnerable to a shell command injection attack. Users should upgrade to version 0.3.6 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-gnupg →
FAQ
python-gnupg is a Python module that provides a high-level interface to GnuPG, allowing users to perform cryptographic operations.
Shell command injection is a security vulnerability that occurs when an attacker is able to inject malicious commands into a command execution process, leading to unauthorized execution of arbitrary code.
This vulnerability allows context-dependent attackers to execute arbitrary code on systems running python-gnupg. The impact may vary depending on the privileges of the user running the vulnerable code.
Yes, the vulnerability can be fixed by upgrading to python-gnupg version 0.3.6 or later.
No, there are no known workarounds for this vulnerability. It is recommended to apply the fix by upgrading the python-gnupg package.
Related vulnerabilities
Recent vulnerabilities recorded for python-gnupg.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.