CVE-2014-1927: python-gnupg_project python-gnupg Improper Input Validation
Vulnerability summary
CVE-2014-1927 is a high (CVSS 7.5) Improper Input Validation vulnerability in python-gnupg_project python-gnupg. EPSS estimates a 3.42% chance of exploitation in the next 30 days, higher than 88.7% of scored vulnerabilities. 3 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 25-10-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.
CVSS metrics
3 scores · 2 sources · 3 versionsEPSS trend
Probability
3.42%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
0.00 pp
From 3.42% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (seclists.org)
Maturity: unknown
Exploit Reference (code.google.com)
Maturity: unknown
Exploit Reference (seclists.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian1 product
- python-gnupg< 0.3.6-1
PyPI1 product
- python-gnupg≥ 0.3.5, < 0.3.6
Python-gnupg_project1 product
- python-gnupg0.3.5
Ubuntu1 product
- python-gnupg< 0.3.6-1
4 vendors · 4 products
