CVE-2018-1000802

critical
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.

References

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html

https://bugs.python.org/issue34540

https://github.com/python/cpython/pull/8985

https://github.com/python/cpython/pull/8985/commits/add531a1e55b0a739b0f42582f1c9747e5649ace

https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html

https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html

https://mega.nz/#!JUFiCC4R!mq-jQ8ySFwIhX6WMDujaZuNBfttDVt7DETlfOIQE1ig

https://usn.ubuntu.com/3817-1/

https://usn.ubuntu.com/3817-2/

https://www.debian.org/security/2018/dsa-4306

Details

Source: MITRE

Published: 2018-09-18

Updated: 2020-12-07

Type: CWE-77

Risk Information

CVSS v2

Base Score: 7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 10

Severity: HIGH

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 3.9

Severity: CRITICAL

Tenable Plugins

View all (24 total)

IDNameProductFamilySeverity
137488EulerOS 2.0 SP2 : python (EulerOS-SA-2020-1646)NessusHuawei Local Security Checks
critical
136219EulerOS Virtualization for ARM 64 3.0.2.0 : python (EulerOS-SA-2020-1516)NessusHuawei Local Security Checks
critical
135634EulerOS Virtualization 3.0.2.2 : python (EulerOS-SA-2020-1472)NessusHuawei Local Security Checks
critical
135556EulerOS 2.0 SP3 : python (EulerOS-SA-2020-1427)NessusHuawei Local Security Checks
critical
133927EulerOS 2.0 SP5 : python (EulerOS-SA-2020-1126)NessusHuawei Local Security Checks
critical
133448SUSE SLES12 Security Update : python36 (SUSE-SU-2020:0302-1)NessusSuSE Local Security Checks
critical
133259SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2020:0234-1) (BEAST) (httpoxy)NessusSuSE Local Security Checks
critical
133172openSUSE Security Update : python3 (openSUSE-2020-86) (BEAST) (httpoxy)NessusSuSE Local Security Checks
critical
133036SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2020:0114-1) (BEAST) (httpoxy)NessusSuSE Local Security Checks
critical
128019SUSE SLES12 Security Update : python3 (SUSE-SU-2019:2053-2)NessusSuSE Local Security Checks
critical
127768SUSE SLED12 / SLES12 Security Update : python3 (SUSE-SU-2019:2053-1)NessusSuSE Local Security Checks
critical
123328openSUSE Security Update : python (openSUSE-2019-765)NessusSuSE Local Security Checks
critical
120704Fedora 29 : python2 (2018-ae70d262b0)NessusFedora Local Security Checks
critical
120340Fedora 28 : python2 (2018-33c7c17e71)NessusFedora Local Security Checks
critical
120119SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2018:3002-1)NessusSuSE Local Security Checks
critical
119571SUSE SLED12 / SLES12 Security Update : python, python-base (SUSE-SU-2018:3554-2)NessusSuSE Local Security Checks
critical
118954Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Python vulnerabilities (USN-3817-1)NessusUbuntu Local Security Checks
critical
118869openSUSE Security Update : python / python-base (openSUSE-2018-1363)NessusSuSE Local Security Checks
critical
118501SUSE SLED12 / SLES12 Security Update : python, python-base (SUSE-SU-2018:3554-1)NessusSuSE Local Security Checks
critical
117982openSUSE Security Update : python (openSUSE-2018-1128)NessusSuSE Local Security Checks
critical
117843Fedora 27 : python2 (2018-c3a5b2029a)NessusFedora Local Security Checks
critical
117812Debian DSA-4306-1 : python2.7 - security updateNessusDebian Local Security Checks
critical
117713Debian DLA-1520-1 : python3.4 security updateNessusDebian Local Security Checks
critical
117712Debian DLA-1519-1 : python2.7 security updateNessusDebian Local Security Checks
critical