CVE-2014-1928: python-gnupg_project python-gnupg Improper Input Validation
Vulnerability summary
CVE-2014-1928 is a medium (CVSS 4.6) Improper Input Validation vulnerability in python-gnupg_project python-gnupg. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 48.1% of scored vulnerabilities. 3 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 25-10-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "\" (backslash) characters to form multi-command sequences, a different vulnerability than CVE-2014-1927. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.
CVSS metrics
3 scores · 2 sources · 3 versionsEPSS trend
Probability
0.61%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
0.00 pp
From 0.61% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (seclists.org)
Maturity: unknown
Exploit Reference (code.google.com)
Maturity: unknown
Exploit Reference (seclists.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian1 product
- python-gnupg< 0.3.6-1
PyPI1 product
- python-gnupg≥ 0.3.5, < 0.3.6 | < 0.3.6
Python-gnupg_project1 product
- python-gnupg≤ 0.3.5
Ubuntu1 product
- python-gnupg< 0.3.6-1 | < 0.3.8-2
4 vendors · 4 products
