CVE-2018-1000802

Publication date 18 September 2018

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
python2.7	18.10 cosmic	Not affected
	18.04 LTS bionic	Fixed 2.7.15~rc1-1ubuntu0.1
	16.04 LTS xenial	Fixed 2.7.12-1ubuntu0~16.04.4
	14.04 LTS trusty	Fixed 2.7.6-8ubuntu0.5
python3.4	18.10 cosmic	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Fixed 3.4.3-1ubuntu1~14.04.7
python3.5	18.10 cosmic	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected
python3.6	18.10 cosmic	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
python3.7	18.10 cosmic	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release

Notes

mdeslaur

later versions of python removed _call_external_zip completely

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
python2.7	Upstream: d8b103b

Severity score breakdown

Parameter	Value
Base score	9.8 · Critical
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H