CVE-2014-1928: python-gnupg - Shell Command Injection
Summary
CVE-2014-1928: The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated usin... Affects python-gnupg versions < 0.3.6. Fixed in 0.3.6. How to fix ↓
Also tracked for
- python-gnupg · Debian:11
The same CVE-2014-1928 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-gnupg is a Python library that provides a high-level interface to GnuPG. It allows users to encrypt, decrypt, sign, and verify files or messages using GnuPG. The library is commonly used in Python applications that require cryptographic functionality. However, python-gnupg version 0.3.5 and earlier are vulnerable to a shell command injection attack.
Vulnerability Detail
The vulnerability in python-gnupg version 0.3.5 arises from the shell_quote function not properly escaping characters. This allows context-dependent attackers to execute arbitrary code by injecting shell metacharacters in unspecified vectors. An attacker can leverage this vulnerability by using backslash characters () to form multi-command sequences. It is important to note that this vulnerability is distinct from CVE-2014-1927 and exists due to an incomplete fix for CVE-2013-7323. The impact of this vulnerability can be severe, as it enables an attacker to execute arbitrary commands on the system where the vulnerable python-gnupg library is being used.
How To Fix
Latest published version: 0.5.7 as of 23 Oct 2026
pip install --upgrade "python-gnupg==0.5.7"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.6
This is the first release that contains the fix.
pip install --upgrade "python-gnupg==0.3.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to validate and sanitize user input before passing it to any shell command execution functions.
Conclusion
The python-gnupg library version 0.3.5 and earlier are vulnerable to a shell command injection attack. This vulnerability can be exploited by injecting shell metacharacters in unspecified vectors, allowing attackers to execute arbitrary commands on the affected system. Users should upgrade to python-gnupg version 0.3.6 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-gnupg →
FAQ
python-gnupg is a Python library that provides a high-level interface to GnuPG, allowing users to perform cryptographic operations such as encryption, decryption, signing, and verification.
The vulnerability allows attackers to execute arbitrary commands on systems where the vulnerable python-gnupg library is being used, potentially leading to unauthorized access, data manipulation, or system compromise.
While specific exploits may not be publicly available, the vulnerability has the potential to be exploited by attackers who can inject shell metacharacters in the appropriate vectors.
Yes, the vulnerability has been addressed in python-gnupg version 0.3.6 and later. Users are advised to upgrade to the latest version to mitigate the risk.
As a general best practice, it is recommended to validate and sanitize user input before using it in shell command execution functions. This can help prevent command injection attacks.
Related vulnerabilities
Recent vulnerabilities recorded for python-gnupg.
