DescriptionPython Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1519-1, DLA-1520-1, DSA-4306-1
NVD severityhigh (attack range: remote)
Debian Bugs909673

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python2.7 (PTS)jessie2.7.9-2+deb8u1vulnerable
jessie (security)2.7.9-2+deb8u2fixed
stretch (security), stretch2.7.13-2+deb9u3fixed
buster, sid2.7.16-2fixed
python3.4 (PTS)jessie3.4.2-1vulnerable
jessie (security)3.4.2-1+deb8u2fixed
python3.5 (PTS)stretch (security), stretch3.5.3-1+deb9u1fixed
python3.7 (PTS)buster, sid3.7.3-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python3.5source(unstable)(not affected)
python3.6source(unstable)(not affected)
python3.7source(unstable)(not affected)


- python3.7 <not-affected> (Fixed before initial upload)
- python3.6 <not-affected> (Fixed before initial upload)
- python3.5 <not-affected> (Fixed before initial upload)
Later versions did remove _call_external_zip with
which used distutils.spawn.

Search for package or bug name: Reporting problems