Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade python2.7 | Sep 28, 2018 | Sep 18, 2018 |
| F5 Big Ip | — | — | May 23, 2024 | Sep 18, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade python-develUpgrade tkinterUpgrade python-libsUpgrade python | Jun 17, 2020 | Sep 18, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade tkinterUpgrade pythonUpgrade python-develUpgrade python-libs | Apr 16, 2020 | Sep 18, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade tkinterUpgrade python-develUpgrade python-libsUpgrade python | Feb 24, 2020 | Sep 18, 2018 |
| Suse | — | Upgrade libpython3_4m1_0Upgrade python-32bitUpgrade python3-base-32bitUpgrade python-xmlUpgrade python-gdbmUpgrade python36-baseUpgrade python3-develUpgrade python36Upgrade python3-testsuiteUpgrade python-cursesUpgrade libpython2_7-1_0Upgrade python3-tkUpgrade python-develUpgrade python3-idleUpgrade libpython3_6m1_0Upgrade python3-32bitUpgrade python3-cursesUpgrade python-docUpgrade libpython3_6m1_0-32bitUpgrade python-baseUpgrade python3Upgrade python-tkUpgrade python3-toolsUpgrade python-base-32bitUpgrade python-idleUpgrade pythonUpgrade libpython2_7-1_0-32bitUpgrade python-demoUpgrade python3-dbmUpgrade libpython3_4m1_0-32bitUpgrade python-doc-pdfUpgrade python3-base | Oct 9, 2018 | Sep 18, 2018 |
| Ubuntu | — | Upgrade python3.4-minimalUpgrade python3.5-minimalUpgrade python2.7-minimalUpgrade python2.7Upgrade python3.4Upgrade python3.5 | Nov 15, 2018 | Sep 18, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 18, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub