CVE-2018-1000802

NameCVE-2018-1000802
DescriptionPython Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1519-1, DLA-1520-1, DSA-4306-1
Debian Bugs909673

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python2.7 (PTS)jessie2.7.9-2+deb8u1vulnerable
jessie (security)2.7.9-2+deb8u2fixed
stretch (security), stretch2.7.13-2+deb9u3fixed
buster, sid2.7.15-5fixed
python3.4 (PTS)jessie3.4.2-1vulnerable
jessie (security)3.4.2-1+deb8u1fixed
python3.5 (PTS)stretch (security), stretch3.5.3-1+deb9u1fixed
python3.6 (PTS)buster, sid3.6.8~rc1-1fixed
python3.7 (PTS)buster, sid3.7.2~rc1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python2.7source(unstable)2.7.15-5909673
python2.7sourcejessie2.7.9-2+deb8u2DLA-1519-1
python2.7sourcestretch2.7.13-2+deb9u3DSA-4306-1
python3.4source(unstable)(unfixed)
python3.4sourcejessie3.4.2-1+deb8u1DLA-1520-1
python3.5source(unstable)(not affected)
python3.6source(unstable)(not affected)
python3.7source(unstable)(not affected)

Notes

- python3.7 <not-affected> (Fixed before initial upload)
- python3.6 <not-affected> (Fixed before initial upload)
- python3.5 <not-affected> (Fixed before initial upload)
https://bugs.python.org/issue34540
https://github.com/python/cpython/commit/d8b103b8b3ef9644805341216963a64098642435
Later versions did remove _call_external_zip with
https://github.com/python/cpython/commit/a0934b2c1b939fdebee8dc18d49a0f6c52324773
which used distutils.spawn.
PoC: https://mega.nz/#!JUFiCC4R!mq-jQ8ySFwIhX6WMDujaZuNBfttDVt7DETlfOIQE1ig

Search for package or bug name: Reporting problems