CVE-2018-1000802

NameCVE-2018-1000802
DescriptionPython Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-1519-1, DLA-1520-1, DSA-4306-1
Debian Bugs909673

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python2.7 (PTS)buster2.7.16-2+deb10u1fixed
buster (security)2.7.16-2+deb10u4fixed
bullseye2.7.18-8+deb11u1fixed
python3.7 (PTS)buster3.7.3-2+deb10u3fixed
buster (security)3.7.3-2+deb10u7fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python2.7sourcejessie2.7.9-2+deb8u2DLA-1519-1
python2.7sourcestretch2.7.13-2+deb9u3DSA-4306-1
python2.7source(unstable)2.7.15-5909673
python3.4sourcejessie3.4.2-1+deb8u1DLA-1520-1
python3.4source(unstable)(unfixed)
python3.5source(unstable)(not affected)
python3.6source(unstable)(not affected)
python3.7source(unstable)(not affected)

Notes

- python3.7 <not-affected> (Fixed before initial upload)
- python3.6 <not-affected> (Fixed before initial upload)
- python3.5 <not-affected> (Fixed before initial upload)
https://bugs.python.org/issue34540
https://github.com/python/cpython/commit/d8b103b8b3ef9644805341216963a64098642435
Later versions did remove _call_external_zip with
https://github.com/python/cpython/commit/a0934b2c1b939fdebee8dc18d49a0f6c52324773
which used distutils.spawn.
PoC: https://mega.nz/#!JUFiCC4R!mq-jQ8ySFwIhX6WMDujaZuNBfttDVt7DETlfOIQE1ig

Search for package or bug name: Reporting problems