{"id":"CVE-2014-1927","published":"2014-10-25T21:00:00Z","modified":"2024-08-06T09:58:15Z","title":"The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent…","vendor":null,"product":null,"tier":"tail","description":{"text":"The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using \"$(\" command-substitution sequences, a different vulnerability than CVE-2014-1928.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.03417,"percentile":0.88847,"provenance":"source"},"cwes":[],"references":[{"url":"http://secunia.com/advisories/56616","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.debian.org/security/2014/dsa-2946","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://seclists.org/oss-sec/2014/q1/245","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://code.google.com/p/python-gnupg/issues/detail?id=98","tags":["x_refsource_CONFIRM"]},{"url":"https://code.google.com/p/python-gnupg/","tags":["x_refsource_CONFIRM"]},{"url":"http://seclists.org/oss-sec/2014/q1/294","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://secunia.com/advisories/59031","tags":["third-party-advisory","x_refsource_SECUNIA"]}],"priority":{"score":17.8,"factors":[{"name":"EPSS percentile","points":17.77}]},"affected":[{"ecosystem":"PyPI","package":"python-gnupg","vulnerableRanges":[">=0.3.5, <0.3.6"],"patched":["0.3.6"],"from":["GHSA-r3vr-prwv-86g9","PYSEC-2014-90"],"provenance":"source"}],"euvd":{"id":"EUVD-2014-0088","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-python-gnupg-cve-2013-7323","parents":[{"from":"CVE-2013-7323","to":"CVE-2014-1927","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.","from":"CVE.org","in":"CVE-2014-1927"},{"kind":"version-step","provenance":"source","package":"PyPI:python-gnupg","fromFixed":"0.3.5","toFixed":"0.3.6","daysApart":138}]}],"packageHistory":[{"cve":"CVE-2014-1927","published":"2014-10-25","fixed":"0.3.6","kev":false},{"cve":"CVE-2014-1928","published":"2014-10-25","fixed":"0.3.6","kev":false},{"cve":"CVE-2013-7323","published":"2014-06-09","fixed":"0.3.7","kev":false},{"cve":"CVE-2014-1929","published":"2014-10-25","fixed":"0.3.7","kev":false}],"package":"PyPI:python-gnupg"}}