VDB

CVE-2018-1000802

CVE-2018-1000802 PUBLISHED CVSS 9.800000190734863 CRITICAL

Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.

EPSS 20.13% · 97.4th percentile

Risk Scores

CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
20.13%
97.4th percentile

Affected Products

VendorProductVersions
Ubuntu:14.04:LTSpython3.43.4~rc1-1build1, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.5
Ubuntu:14.04:LTSpython2.72.7.6-8, 0, 2.7.5-8ubuntu3
Ubuntu:18.04:LTSpython2.72.7.14-6, 2.7.14-7, 2.7.14-8
Ubuntu:16.04:LTSpython2.72.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.1, 2.7.12-1~16.04

Timeline

  • Sep 18, 2018 CVE Published
  • Apr 14, 2021 EPSS Score
  • Aug 24, 2021 EPSS Score
  • Dec 28, 2021 EPSS Score
  • Feb 28, 2022 EPSS Score
  • Jul 4, 2022 EPSS Score
  • Sep 6, 2022 EPSS Score
  • Jan 9, 2023 EPSS Score
  • Mar 13, 2023 EPSS Score
  • Jul 16, 2023 EPSS Score
  • Nov 18, 2023 EPSS Score
  • Mar 23, 2024 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›