CVE-2014-1927

python-gnupg 0.3.5 - Remote Code Execution via Shell Metacharacter Injection

Title source: llm
STIX 2.1

Description

The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.

References (7)

Core 7
Core References
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/56616
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2014/dsa-2946
Exploit mailing-list x_refsource_mlist
http://seclists.org/oss-sec/2014/q1/245
Issue Tracking x_refsource_confirm
https://code.google.com/p/python-gnupg/
Exploit mailing-list x_refsource_mlist
http://seclists.org/oss-sec/2014/q1/294
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/59031

Scores

EPSS 0.0339
EPSS Percentile 87.4%

Details

CWE
CWE-20
Status published
Products (2)
pypi/python-gnupg 0.3.5 - 0.3.6PyPI
python-gnupg_project/python-gnupg 0.3.5
Published Oct 25, 2014
Tracked Since Feb 18, 2026