{"id":"CVE-2014-1928","published":"2014-10-25T21:00:00Z","modified":"2024-08-06T09:58:15Z","title":"The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent…","vendor":null,"product":null,"tier":"tail","description":{"text":"The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using \"\\\" (backslash) characters to form multi-command sequences, a different vulnerability than CVE-2014-1927.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.0061,"percentile":0.49048,"provenance":"source"},"cwes":[],"references":[{"url":"http://secunia.com/advisories/56616","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://seclists.org/oss-sec/2014/q1/246","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.debian.org/security/2014/dsa-2946","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://code.google.com/p/python-gnupg/issues/detail?id=98","tags":["x_refsource_CONFIRM"]},{"url":"https://code.google.com/p/python-gnupg/","tags":["x_refsource_CONFIRM"]},{"url":"http://seclists.org/oss-sec/2014/q1/294","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://secunia.com/advisories/59031","tags":["third-party-advisory","x_refsource_SECUNIA"]}],"priority":{"score":9.8,"factors":[{"name":"EPSS percentile","points":9.81}]},"affected":[{"ecosystem":"PyPI","package":"python-gnupg","vulnerableRanges":[">=0.3.5, <0.3.6","<0.3.6"],"patched":["0.3.6"],"from":["GHSA-2jc8-4r6g-282j","PYSEC-2014-91"],"provenance":"source"}],"euvd":{"id":"EUVD-2014-0089","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-python-gnupg-cve-2013-7323","parents":[{"from":"CVE-2013-7323","to":"CVE-2014-1928","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.","from":"CVE.org","in":"CVE-2014-1928"},{"kind":"version-step","provenance":"source","package":"PyPI:python-gnupg","fromFixed":"0.3.5","toFixed":"0.3.6","daysApart":138}]}],"packageHistory":[{"cve":"CVE-2014-1927","published":"2014-10-25","fixed":"0.3.6","kev":false},{"cve":"CVE-2014-1928","published":"2014-10-25","fixed":"0.3.6","kev":false},{"cve":"CVE-2013-7323","published":"2014-06-09","fixed":"0.3.7","kev":false},{"cve":"CVE-2014-1929","published":"2014-10-25","fixed":"0.3.7","kev":false,"link":{"from":"CVE-2014-1928","to":"CVE-2014-1929","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:python-gnupg","fromFixed":"0.3.6","toFixed":"0.3.7","daysApart":0}]}},{"cve":"CVE-2019-6690","published":"2019-03-17","fixed":"0.4.4","kev":false}],"package":"PyPI:python-gnupg"}}