CVE-2014-1928

python-gnupg < 0.3.5 - OS Command Injection via Shell Metacharacter Bypass

Title source: llm
STIX 2.1

Description

The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "\" (backslash) characters to form multi-command sequences, a different vulnerability than CVE-2014-1927. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.

References (7)

Core 7
Core References
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/56616
Exploit mailing-list x_refsource_mlist
http://seclists.org/oss-sec/2014/q1/246
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2014/dsa-2946
Exploit, Vendor Advisory x_refsource_confirm
https://code.google.com/p/python-gnupg/issues/detail?id=98
Issue Tracking x_refsource_confirm
https://code.google.com/p/python-gnupg/
Exploit mailing-list x_refsource_mlist
http://seclists.org/oss-sec/2014/q1/294
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/59031

Scores

EPSS 0.0060
EPSS Percentile 44.7%

Details

CWE
CWE-20
Status published
Products (2)
pypi/python-gnupg 0.3.5 - 0.3.6PyPI
python-gnupg_project/python-gnupg < 0.3.5
Published Oct 25, 2014
Tracked Since Feb 18, 2026