Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade python2.7 | Sep 28, 2018 | Sep 18, 2018 |
| F5 Big Ip | — | — | May 23, 2024 | Sep 18, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade python-develUpgrade pythonUpgrade tkinterUpgrade python-libs | Jun 17, 2020 | Sep 18, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade tkinterUpgrade pythonUpgrade python-libsUpgrade python-devel | Apr 16, 2020 | Sep 18, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade python-libsUpgrade pythonUpgrade python-develUpgrade tkinter | Feb 24, 2020 | Sep 18, 2018 |
| Suse | — | Upgrade python-baseUpgrade python-doc-pdfUpgrade python-docUpgrade libpython3_4m1_0-32bitUpgrade pythonUpgrade python-tkUpgrade python3Upgrade python-base-32bitUpgrade python3-baseUpgrade python3-toolsUpgrade python3-dbmUpgrade libpython2_7-1_0-32bitUpgrade python-idleUpgrade libpython3_6m1_0-32bitUpgrade python-demoUpgrade python-develUpgrade python3-32bitUpgrade python3-testsuiteUpgrade python-32bitUpgrade python3-base-32bitUpgrade python3-tkUpgrade libpython3_6m1_0Upgrade python-xmlUpgrade python3-develUpgrade python36-baseUpgrade python3-cursesUpgrade python3-idleUpgrade libpython2_7-1_0Upgrade python-gdbmUpgrade libpython3_4m1_0Upgrade python36Upgrade python-curses | Oct 9, 2018 | Sep 18, 2018 |
| Ubuntu | — | Upgrade python3.5Upgrade python2.7Upgrade python3.4Upgrade python3.4-minimalUpgrade python3.5-minimalUpgrade python2.7-minimal | Nov 15, 2018 | Sep 18, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 18, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub