Published: 18/09/2018 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.

Vulnerable Product	Search on Vulmon	Subscribe to Product
python python
debian debian linux 8.0
canonical ubuntu linux 16.04
debian debian linux 9.0
canonical ubuntu linux 12.04
canonical ubuntu linux 18.04
canonical ubuntu linux 14.04
opensuse leap 15.1

Debian Bug report logs - #909673 python27: CVE-2018-1000802 Package: python27; Maintainer for python27 is Matthias Klose <doko@debianorg>; Source for python27 is src:python27 (PTS, buildd, popcon) Reported by: Antoine Beaupre <anarcat@orangeseedsorg> Date: Wed, 26 Sep 2018 15:12:02 UTC Severity: grave Tags: f ...

Several security issues were fixed in Python ...

Python CVE-2018-1000802 Proof-of-Concept

Python CVE-2018-1000802 Proof-of-Concept This is a PoC for the vulnerability in make_archive function exported by shutil builtin module Vulnerability is present in CPython (Python) 27 prior to commit add531a1e55b0a739b0f42582f1c9747e5649ace For the vulnerability to be exploitable in the wild there are several conditions: Code must run on Windows machine; There must be a zip

Ethical hacking, made easy.

A minimalistic Python framework for fast and centralized ethical hacking Endorsements "Really cool tool sets for specific tasks or combinations together :) great work!" todayisnew "Kitsec impressed me It's user-friendly and centralized, making it fast and efficient It offers a wide range of capabilities, including OWASP Top 10 coverage, fuzzing,

CWE-77 https://github.com/python/cpython/pull/8985/commits/add531a1e55b0a739b0f42582f1c9747e5649ace https://github.com/python/cpython/pull/8985 https://bugs.python.org/issue34540 https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html https://www.debian.org/security/2018/dsa-4306 https://usn.ubuntu.com/3817-1/https://usn.ubuntu.com/3817-2/http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html https://security.netapp.com/advisory/ntap-20230309-0002/https://mega.nz/#%21JUFiCC4R%21mq-jQ8ySFwIhX6WMDujaZuNBfttDVt7DETlfOIQE1ig https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=909673 https://nvd.nist.gov https://usn.ubuntu.com/3817-1/

CVE-2018-1000802

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect