CVE-2018-1000802
criticalPython Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')…
Vendor / product: Python — python
Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2018-09-18 17:29
Modified: 2026-10-08 21:17
NVD status: Modified
Last synced 2 days ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
python / python ≥2.7.0 <2.7.16
canonical / ubuntu_linux 12.04, 14.04, 16.04, 18.04
debian / debian_linux 8.0, 9.0
opensuse / leap 15.1
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://bugs.python.org/issue34540
Vendor advisory: https://github.com/python/cpython/pull/8985
Vendor advisory: https://github.com/python/cpython/pull/8985/commits/add531a1e55b0a739b0f42582f1c9747e5649ace
Vendor advisory: https://bugs.python.org/issue34540
Vendor advisory: https://github.com/python/cpython/pull/8985
Vendor advisory: https://github.com/python/cpython/pull/8985/commits/add531a1e55b0a739b0f42582f1c9747e5649ace
Patch / mitigation: https://bugs.python.org/issue34540
Patch / mitigation: https://github.com/python/cpython/pull/8985
Patch / mitigation: https://github.com/python/cpython/pull/8985/commits/add531a1e55b0a739b0f42582f1c9747e5649ace
Patch / mitigation: https://bugs.python.org/issue34540
Patch / mitigation: https://github.com/python/cpython/pull/8985
References
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html cve@mitre.org
- https://bugs.python.org/issue34540 cve@mitre.org
- https://github.com/python/cpython/pull/8985 cve@mitre.org
- https://github.com/python/cpython/pull/8985/commits/add531a1e55b0a739b0f42582f1c9747e5649a... cve@mitre.org
- https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html cve@mitre.org
- https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html cve@mitre.org
- https://mega.nz/#%21JUFiCC4R%21mq-jQ8ySFwIhX6WMDujaZuNBfttDVt7DETlfOIQE1ig cve@mitre.org
- https://security.netapp.com/advisory/ntap-20230309-0002/ cve@mitre.org
- https://usn.ubuntu.com/3817-1/ cve@mitre.org
- https://usn.ubuntu.com/3817-2/ cve@mitre.org
- https://www.debian.org/security/2018/dsa-4306 cve@mitre.org
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html af854a3a-2127-422b-91ae-364da2661108
- https://bugs.python.org/issue34540 af854a3a-2127-422b-91ae-364da2661108
- https://github.com/python/cpython/pull/8985 af854a3a-2127-422b-91ae-364da2661108
- https://github.com/python/cpython/pull/8985/commits/add531a1e55b0a739b0f42582f1c9747e5649a... af854a3a-2127-422b-91ae-364da2661108
- https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html af854a3a-2127-422b-91ae-364da2661108
- https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html af854a3a-2127-422b-91ae-364da2661108
- https://mega.nz/#%21JUFiCC4R%21mq-jQ8ySFwIhX6WMDujaZuNBfttDVt7DETlfOIQE1ig af854a3a-2127-422b-91ae-364da2661108
- https://security.netapp.com/advisory/ntap-20230309-0002/ af854a3a-2127-422b-91ae-364da2661108
- https://usn.ubuntu.com/3817-1/ af854a3a-2127-422b-91ae-364da2661108
- https://usn.ubuntu.com/3817-2/ af854a3a-2127-422b-91ae-364da2661108
- https://www.debian.org/security/2018/dsa-4306 af854a3a-2127-422b-91ae-364da2661108
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗