Executive brief
python-gnupg is a Python library for interacting with GnuPG encryption tools. A flaw in its shell_quote function fails to properly escape special shell characters, allowing attackers to inject arbitrary shell commands and execute code when the library processes untrusted input.
Technical details
The shell_quote function in python-gnupg 0.3.5 does not properly sanitize shell metacharacters, particularly backslash characters, allowing command injection attacks. This is a context-dependent vulnerability where attackers can craft malicious input containing shell metacharacters to form multi-command sequences. The vulnerability exists in an incomplete fix for CVE-2013-7323. Attack requires passing untrusted input through the vulnerable function, but does not require authentication or user interaction. An attacker can execute arbitrary shell commands with the privileges of the process running python-gnupg. The vulnerability was patched in version 0.3.6.
Affected products
- python-gnupg python-gnupg 0.3.5
Timeline
- 2014-01: disclosed: Vulnerability disclosed via oss-sec mailing list
- 2014: patched: Fixed in version 0.3.6
- 2018-11-06: advisory: GitHub advisory GHSA-2jc8-4r6g-282j published