9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.01 Low
EPSS
Percentile
83.1%
Python Software Foundation Python (CPython) version 2.7 contains a CWE-77:
Improper Neutralization of Special Elements used in a Command (‘Command
Injection’) vulnerability in shutil module (make_archive function) that can
result in Denial of service, Information gain via injection of arbitrary
files on the system or entire drive. This attack appear to be exploitable
via Passage of unfiltered user input to the function. This vulnerability
appears to have been fixed in after commit
add531a1e55b0a739b0f42582f1c9747e5649ace.
Author | Note |
---|---|
mdeslaur | later versions of python removed _call_external_zip completely |
launchpad.net/bugs/cve/CVE-2018-1000802
mega.nz/#!JUFiCC4R!mq-jQ8ySFwIhX6WMDujaZuNBfttDVt7DETlfOIQE1ig
nvd.nist.gov/vuln/detail/CVE-2018-1000802
security-tracker.debian.org/tracker/CVE-2018-1000802
ubuntu.com/security/notices/USN-3817-1
ubuntu.com/security/notices/USN-3817-2
www.cve.org/CVERecord?id=CVE-2018-1000802
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.01 Low
EPSS
Percentile
83.1%