Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting the affect functionality component.
Recommended action: Upgrade to 0.4.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The shellquote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.
Recommended action: Upgrade to 0.3.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.
Recommended action: Upgrade to 0.3.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The shellquote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "\" (backslash) characters to form multi-command sequences, a different vulnerability than CVE-2014-1927. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.
Recommended action: Upgrade to 0.3.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
python-gnupg 0.3.5 and 0.3.6 allow for shell injection via a failure to escape backslashes in the shellquote() function. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.
Recommended action: Upgrade to 0.3.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.