CVE-2018-1000802

CRITICAL 9.8CVE-2018-1000802 · Published 18/09/2018 · updated 08/10/2026

Package	Affected versions	Patched versions
python python	`≥ 2.7.0, < 2.7.16`	`2.7.16`

Description

Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.

References

lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html · Mailing List
bugs.python.org/issue34540 · Issue Tracking
python/cpython#8985 · Patch
python/cpython#8985 · Patch
lists.debian.org/debian-lts-announce/2018/09/msg00030.html · Mailing List
lists.debian.org/debian-lts-announce/2018/09/msg00031.html · Mailing List
mega.nz
security.netapp.com/advisory/ntap-20230309-0002
usn.ubuntu.com/3817-1 · Third Party Advisory
usn.ubuntu.com/3817-2 · Third Party Advisory
debian.org/security/2018/dsa-4306 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free