vsajip/python-gnupg

GitHub

github.com

docs.red-dove.com

Releases22

Frequency6 months 3 weeks

Last Release7 months ago

Stars144

A Python API for the GNU Privacy Guard (GnuPG). Encrypt, decrypt, sign and verify your data using Python! N.B. This repository has been migrated from Mercurial on 2019-11-16, so references to commits before this date will refer to the Mercurial source and not this Git repository. The migration is marked by a commit that adds a .gitignore file.

CVE History

CVE	Affected	Published	CVSS v3	CVSS v2
CVE-2019-6690NVD↗	= 0.4.3	Mar 21, 2019Thursday, 21 March 2019, 16:01	7.5 HIGH	5 MEDIUM
python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting the affect functionality component.
CVE-2014-1927NVD↗	= 0.3.5	Oct 25, 2014Saturday, 25 October 2014, 21:55	—	7.5 HIGH
The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.
CVE-2014-1928NVD↗	<= 0.3.5	Oct 25, 2014Saturday, 25 October 2014, 21:55	—	4.6 MEDIUM
The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "\" (backslash) characters to form multi-command sequences, a different vulnerability than CVE-2014-1927. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.
CVE-2014-1929NVD↗	= 0.3.5, = 0.3.6	Oct 25, 2014Saturday, 25 October 2014, 21:55	—	4.4 MEDIUM
python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection through positional arguments." NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.