The vulnerability of the `make_archive` function in the `shutil` module of the Python programming language interpreter (CPython) allows a malicious actor to trigger a service failure or gain unauthorized access to information.

🗓️ 05 Feb 2019 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 11 Views

A flaw in Python shutil make_archive input filtering risks service failure or data access.

Reporter	Title	Published	Views	Family All 131
GithubExploit	Exploit for Command Injection in Python	14 Sep 201816:22	–	githubexploit
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private Vulnerability Advisor Kafka and Notification Dispatcher	7 Mar 201920:05	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private Management Ingress and Kubernetes	12 Mar 201921:40	–	ibm
Cloud Foundry	USN-3817-1: Python vulnerabilities \| Cloud Foundry	20 Nov 201800:00	–	cloudfoundry
CVE	CVE-2018-1000802	18 Sep 201800:00	–	cve
Cvelist	CVE-2018-1000802	18 Sep 201800:00	–	cvelist
Debian	[SECURITY] [DLA 1519-1] python2.7 security update	25 Sep 201823:47	–	debian
Debian	[SECURITY] [DLA 1520-1] python3.4 security update	26 Sep 201800:26	–	debian
Debian	[SECURITY] [DSA 4306-1] python2.7 security update	27 Sep 201821:05	–	debian
Debian CVE	CVE-2018-1000802	18 Sep 201800:00	–	debiancve

Vulners

Node

python cpythonMatch2.7

Source	Link
bugs	www.bugs.python.org/issue34540
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-1000802
security-tracker	www.security-tracker.debian.org/tracker/CVE-2018-1000802
mega	www.mega.nz/
wiki	www.wiki.astralinux.ru/pages/viewpage.action
web	www.web.nvd.nist.gov/view/vuln/detail

23 Mar 2021 00:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 27.5

CVSS 39.8

EPSS0.20807

python shutil make archive input filtering vulnerability