Skip to content
Fencer Vulns
critical 9.8

CVE-2018-1000802 in the critical feed json

Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('…

published 2018-09-18 8 y ago modified 2026-10-08 31 d ago also EUVD-2018-2006

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
20.1%
EPSS 20.1% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.

Patch / fix

  • python python 2.7.16
  • python2.7 Debian 11 2.7.15-5

debian advisories DEBIAN-CVE-2018-1000802

  • python2.7 Ubuntu 14.04 LTS 2.7.6-8ubuntu0.5
  • python2.7 Ubuntu 16.04 LTS 2.7.12-1ubuntu0~16.04.4
  • python2.7 Ubuntu 18.04 LTS 2.7.15~rc1-1ubuntu0.1
  • python3.4 Ubuntu 14.04 LTS 3.4.3-1ubuntu1~14.04.7

ubuntu advisories UBUNTU-CVE-2018-1000802

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python36 SLES for SAP 12 SP5, SLES 12 SP5 3.6.10-4.3.5
  • python36-base SLES for SAP 12 SP5, SLES 12 SP5 3.6.10-4.3.5
  • python SLE Module for Python 2 15 SP1, SLE Module for Desktop Applications 15 SP1, SLE Module for Desktop Applications 15 +2 more 2.7.17-7.32.2
  • python-base SLE Module for Python 2 15 SP1, SLE Module for Basesystem 15 SP1, SLE Module for Basesystem 15 2.7.17-7.32.1
  • python3 SLE Module for Basesystem 15 SP1, SLE Module for Basesystem 15 3.6.10-3.42.2
  • python3-base SLE Module for Development Tools 15 SP1, SLE Module for Development Tools 15, SLE Module for Basesystem 15 SP1 +1 more 3.6.10-3.42.2
  • python3 SLES 12 SP4, SLES 12 SP3-BCL, SLES 12 SP2-BCL +16 more 3.4.6-25.29.1
  • python3-base SLES 12 SP4, SLES 12 SP3-BCL, SLES 12 SP2-BCL +16 more 3.4.6-25.29.1

suse advisories SUSE-SU-2020:0302-1SUSE-SU-2020:0234-1SUSE-SU-2020:0114-1SUSE-SU-2019:2053-1SUSE-SU-2019:2053-2SUSE-SU-2018:3554-2

  • python openSUSE Tumbleweed 2.7.18-8.1
  • python36 openSUSE Tumbleweed 3.6.15-1.1
  • python3 openSUSE Leap 15.1 3.6.10-lp151.6.7.1
  • python3-base openSUSE Leap 15.1 3.6.10-lp151.6.7.1

opensuse advisories openSUSE-SU-2024:11202-1openSUSE-SU-2024:11284-1openSUSE-SU-2020:0086-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-1000802 updated cvss 6.5

python: Command injection in the shutil module

  • Red Hat Enterprise Linux 5 python Red Hat Enterprise Linux 6 python, tkinter, python-libs, python-test, python-tools Red Hat Enterprise Linux 7 python, tkinter, python-libs, python-test, python-tools Red Hat Software Collections python27-python, python27-tkinter, rh-python35-python, rh-python36-python, python27-python-libs, python27-python-test, +9 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
31 d ago

Exploit prediction

20.13% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.