CVE catalog

CVE-2018-1000802

Security update for python3

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Published
Updated
Source
[NVD] · [CVE record]
EPSS
20.13% · Oct 27, 2026

Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpython2.7112.7.15-5fixed
Ubuntupython2.714.042.7.5-8ubuntu3vulnerable
Ubuntupython2.714.042.7.5-8ubuntu4vulnerable
Ubuntupython2.714.042.7.6-2vulnerable
Ubuntupython2.714.042.7.6-2ubuntu1vulnerable
Ubuntupython2.714.042.7.6-3vulnerable
Ubuntupython2.714.042.7.6-3ubuntu1vulnerable
Ubuntupython2.714.042.7.6-4vulnerable
Ubuntupython2.714.042.7.6-4ubuntu1vulnerable
Ubuntupython2.714.042.7.6-5vulnerable
Ubuntupython2.714.042.7.6-7vulnerable
Ubuntupython2.714.042.7.6-8vulnerable
Ubuntupython2.714.042.7.6-8ubuntu0.2vulnerable
Ubuntupython2.714.042.7.6-8ubuntu0.3vulnerable
Ubuntupython2.714.042.7.6-8ubuntu0.4vulnerable
Ubuntupython2.714.042.7.6-8ubuntu0.5fixed
Ubuntupython3.414.043.4~b1-0ubuntu3vulnerable
Ubuntupython3.414.043.4~b1-4ubuntu4vulnerable
Ubuntupython3.414.043.4~b1-4ubuntu6vulnerable
Ubuntupython3.414.043.4~b1-5ubuntu2vulnerable
Ubuntupython3.414.043.4~b2-1vulnerable
Ubuntupython3.414.043.4~b3-1ubuntu1vulnerable
Ubuntupython3.414.043.4~rc1-1build1vulnerable
Ubuntupython3.414.043.4~rc2-1vulnerable
Ubuntupython3.414.043.4~rc3-0ubuntu1vulnerable
Ubuntupython3.414.043.4.0-1vulnerable
Ubuntupython3.414.043.4.0-2ubuntu1vulnerable
Ubuntupython3.414.043.4.0-2ubuntu1.1vulnerable
Ubuntupython3.414.043.4.3-1ubuntu1~14.04.1vulnerable
Ubuntupython3.414.043.4.3-1ubuntu1~14.04.3vulnerable
Ubuntupython3.414.043.4.3-1ubuntu1~14.04.4vulnerable
Ubuntupython3.414.043.4.3-1ubuntu1~14.04.5vulnerable
Ubuntupython3.414.043.4.3-1ubuntu1~14.04.6vulnerable
Ubuntupython3.414.043.4.3-1ubuntu1~14.04.7fixed
Ubuntupython2.716.042.7.10-4ubuntu1vulnerable
Ubuntupython2.716.042.7.10-4ubuntu2vulnerable
Ubuntupython2.716.042.7.11-2vulnerable
Ubuntupython2.716.042.7.11-3vulnerable
Ubuntupython2.716.042.7.11-4vulnerable
Ubuntupython2.716.042.7.11-6vulnerable
Ubuntupython2.716.042.7.11-7vulnerable
Ubuntupython2.716.042.7.11-7ubuntu1vulnerable
Ubuntupython2.716.042.7.12-1~16.04vulnerable
Ubuntupython2.716.042.7.12-1ubuntu0~16.04.1vulnerable
Ubuntupython2.716.042.7.12-1ubuntu0~16.04.2vulnerable
Ubuntupython2.716.042.7.12-1ubuntu0~16.04.3vulnerable
Ubuntupython2.716.042.7.12-1ubuntu0~16.04.4fixed
Ubuntupython2.718.042.7.14-2ubuntu2vulnerable
Ubuntupython2.718.042.7.14-4vulnerable
Ubuntupython2.718.042.7.14-6vulnerable
Ubuntupython2.718.042.7.14-7vulnerable
Ubuntupython2.718.042.7.14-8vulnerable
Ubuntupython2.718.042.7.15~rc1-1vulnerable
Ubuntupython2.718.042.7.15~rc1-1ubuntu0.1fixed
Debianpython2.792.7.13-2vulnerable
Debianpython2.792.7.13-2+deb9u1vulnerable
Debianpython2.792.7.13-2+deb9u2vulnerable
Debianpython2.792.7.13-2+deb9u3fixed
Susepythonlinux enterprise module for basesystem 152.7.14-7.3.1fixed
Susepython-baselinux enterprise module for basesystem 152.7.14-7.3.1fixed
Susepythonlinux enterprise module for desktop applications 152.7.14-7.3.1fixed
Susepythonlinux enterprise desktop 12 sp32.7.13-28.16.1fixed
Susepython-baselinux enterprise desktop 12 sp32.7.13-28.16.1fixed
Susepython-baselinux enterprise software development kit 12 sp32.7.13-28.16.1fixed
Susepythonlinux enterprise server 12 sp32.7.13-28.16.1fixed
Susepython-baselinux enterprise server 12 sp32.7.13-28.16.1fixed
Susepython-doclinux enterprise server 12 sp32.7.13-28.16.1fixed
Susepythonlinux enterprise server for sap applications 12 sp32.7.13-28.16.1fixed
Susepython-baselinux enterprise server for sap applications 12 sp32.7.13-28.16.1fixed
Susepython-doclinux enterprise server for sap applications 12 sp32.7.13-28.16.1fixed
Susepython-baselinux enterprise workstation extension 12 sp32.7.13-28.16.1fixed
Susepythonenterprise storage 52.7.13-28.16.1fixed
Susepython3openstack cloud 73.4.6-25.29.1fixed
Susepython3-baseopenstack cloud 73.4.6-25.29.1fixed
Susepython3openstack cloud 83.4.6-25.29.1fixed
Susepython3-baseopenstack cloud 83.4.6-25.29.1fixed
Susepython3linux enterprise desktop 12 sp43.4.6-25.29.1fixed
Susepython3-baselinux enterprise desktop 12 sp43.4.6-25.29.1fixed
Susepython3linux enterprise module for web and scripting 123.4.6-25.29.1fixed
Susepython3-baselinux enterprise module for web and scripting 123.4.6-25.29.1fixed
Susepython3linux enterprise server for sap applications 12 sp13.4.6-25.29.1fixed
Susepython3-baselinux enterprise server for sap applications 12 sp13.4.6-25.29.1fixed
Susepython3linux enterprise server for sap applications 12 sp23.4.6-25.29.1fixed
Susepython3-baselinux enterprise server for sap applications 12 sp23.4.6-25.29.1fixed
Susepython3linux enterprise server for sap applications 12 sp33.4.6-25.29.1fixed
Susepython3-baselinux enterprise server for sap applications 12 sp33.4.6-25.29.1fixed
Susepython3linux enterprise software development kit 12 sp43.4.6-25.29.1fixed
Susepython3-baselinux enterprise software development kit 12 sp43.4.6-25.29.1fixed
Susepython3linux enterprise server 12 sp1-ltss3.4.6-25.29.1fixed
Susepython3-baselinux enterprise server 12 sp1-ltss3.4.6-25.29.1fixed
Susepython3linux enterprise server 12 sp2-ltss3.4.6-25.29.1fixed
Susepython3-baselinux enterprise server 12 sp2-ltss3.4.6-25.29.1fixed
Susepython3linux enterprise server 12 sp2-bcl3.4.6-25.29.1fixed
Susepython3-baselinux enterprise server 12 sp2-bcl3.4.6-25.29.1fixed
Susepython3linux enterprise server 12 sp3-ltss3.4.6-25.29.1fixed
Susepython3-baselinux enterprise server 12 sp3-ltss3.4.6-25.29.1fixed
Susepython3linux enterprise server 12 sp43.4.6-25.29.1fixed
Susepython3-baselinux enterprise server 12 sp43.4.6-25.29.1fixed
Susepython3linux enterprise server for sap applications 12 sp43.4.6-25.29.1fixed
Susepython3-baselinux enterprise server for sap applications 12 sp43.4.6-25.29.1fixed
Susepython3enterprise storage 43.4.6-25.29.1fixed
Susepython3-baseenterprise storage 43.4.6-25.29.1fixed
Susepython3enterprise storage 53.4.6-25.29.1fixed
Susepython3-baseenterprise storage 53.4.6-25.29.1fixed
Susepythonlinux enterprise desktop 12 sp42.7.13-28.16.1fixed
Susepython-baselinux enterprise desktop 12 sp42.7.13-28.16.1fixed
Susepython-baselinux enterprise software development kit 12 sp42.7.13-28.16.1fixed
Susepythonlinux enterprise server 12 sp42.7.13-28.16.1fixed
Susepython-baselinux enterprise server 12 sp42.7.13-28.16.1fixed
Susepython-doclinux enterprise server 12 sp42.7.13-28.16.1fixed
Susepythonlinux enterprise server for sap applications 12 sp42.7.13-28.16.1fixed
Susepython-baselinux enterprise server for sap applications 12 sp42.7.13-28.16.1fixed
Susepython-doclinux enterprise server for sap applications 12 sp42.7.13-28.16.1fixed
Susepython-baselinux enterprise workstation extension 12 sp42.7.13-28.16.1fixed
Susepython3hpe helion openstack 83.4.6-25.29.1fixed
Susepython3-basehpe helion openstack 83.4.6-25.29.1fixed
Susepython3openstack cloud crowbar 83.4.6-25.29.1fixed
Susepython3-baseopenstack cloud crowbar 83.4.6-25.29.1fixed
Susepython3linux enterprise server 12 sp3-ltss3.4.6-25.29.1fixed
Susepython3-baselinux enterprise server 12 sp3-ltss3.4.6-25.29.1fixed
Susepython3linux enterprise server 12 sp3-bcl3.4.6-25.29.1fixed
Susepython3-baselinux enterprise server 12 sp3-bcl3.4.6-25.29.1fixed
Susepython3enterprise storage 53.4.6-25.29.1fixed
Susepython3-baseenterprise storage 53.4.6-25.29.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpython2.7deb112.7.15-5Not reportedDEBIAN-CVE-2018-1000802Not reported
Ubuntupython2.7deb14.042.7.6-8ubuntu0.5Not reportedUBUNTU-CVE-2018-1000802Not reported
Ubuntupython3.4deb14.043.4.3-1ubuntu1~14.04.7Not reportedUBUNTU-CVE-2018-1000802Not reported
Ubuntupython2.7deb16.042.7.12-1ubuntu0~16.04.4Not reportedUBUNTU-CVE-2018-1000802Not reported
Ubuntupython2.7deb18.042.7.15~rc1-1ubuntu0.1Not reportedUBUNTU-CVE-2018-1000802Not reported
Debianpython2.7deb92.7.13-2+deb9u3Not reportedDSA-4306-1Not reported
Susepythonrpmlinux enterprise module for basesystem 152.7.14-7.3.1Not reportedSUSE-SU-2018:3002-1Not reported
Susepython-baserpmlinux enterprise module for basesystem 152.7.14-7.3.1Not reportedSUSE-SU-2018:3002-1Not reported
Susepythonrpmlinux enterprise module for desktop applications 152.7.14-7.3.1Not reportedSUSE-SU-2018:3002-1Not reported
Susepythonrpmlinux enterprise desktop 12 sp32.7.13-28.16.1Not reportedSUSE-SU-2018:3554-1Not reported
Susepython-baserpmlinux enterprise desktop 12 sp32.7.13-28.16.1Not reportedSUSE-SU-2018:3554-1Not reported
Susepython-baserpmlinux enterprise software development kit 12 sp32.7.13-28.16.1Not reportedSUSE-SU-2018:3554-1Not reported
Susepythonrpmlinux enterprise server 12 sp32.7.13-28.16.1Not reportedSUSE-SU-2018:3554-1Not reported
Susepython-baserpmlinux enterprise server 12 sp32.7.13-28.16.1Not reportedSUSE-SU-2018:3554-1Not reported
Susepython-docrpmlinux enterprise server 12 sp32.7.13-28.16.1Not reportedSUSE-SU-2018:3554-1Not reported
Susepythonrpmlinux enterprise server for sap applications 12 sp32.7.13-28.16.1Not reportedSUSE-SU-2018:3554-1Not reported
Susepython-baserpmlinux enterprise server for sap applications 12 sp32.7.13-28.16.1Not reportedSUSE-SU-2018:3554-1Not reported
Susepython-docrpmlinux enterprise server for sap applications 12 sp32.7.13-28.16.1Not reportedSUSE-SU-2018:3554-1Not reported
Susepython-baserpmlinux enterprise workstation extension 12 sp32.7.13-28.16.1Not reportedSUSE-SU-2018:3554-1Not reported
Susepythonrpmenterprise storage 52.7.13-28.16.1Not reportedSUSE-SU-2018:3554-1Not reported
Susepython3rpmopenstack cloud 73.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3-baserpmopenstack cloud 73.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3rpmopenstack cloud 83.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3-baserpmopenstack cloud 83.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3rpmlinux enterprise desktop 12 sp43.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3-baserpmlinux enterprise desktop 12 sp43.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3rpmlinux enterprise module for web and scripting 123.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3-baserpmlinux enterprise module for web and scripting 123.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3rpmlinux enterprise server for sap applications 12 sp13.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3-baserpmlinux enterprise server for sap applications 12 sp13.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3rpmlinux enterprise server for sap applications 12 sp23.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3-baserpmlinux enterprise server for sap applications 12 sp23.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3rpmlinux enterprise server for sap applications 12 sp33.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3-baserpmlinux enterprise server for sap applications 12 sp33.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3rpmlinux enterprise software development kit 12 sp43.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3-baserpmlinux enterprise software development kit 12 sp43.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3rpmlinux enterprise server 12 sp1-ltss3.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3-baserpmlinux enterprise server 12 sp1-ltss3.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3rpmlinux enterprise server 12 sp2-ltss3.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3-baserpmlinux enterprise server 12 sp2-ltss3.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3rpmlinux enterprise server 12 sp2-bcl3.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3-baserpmlinux enterprise server 12 sp2-bcl3.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3rpmlinux enterprise server 12 sp3-ltss3.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3-baserpmlinux enterprise server 12 sp3-ltss3.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3rpmlinux enterprise server 12 sp43.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3-baserpmlinux enterprise server 12 sp43.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3rpmlinux enterprise server for sap applications 12 sp43.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3-baserpmlinux enterprise server for sap applications 12 sp43.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3rpmenterprise storage 43.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3-baserpmenterprise storage 43.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3rpmenterprise storage 53.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepython3-baserpmenterprise storage 53.4.6-25.29.1Not reportedSUSE-SU-2019:2053-1Not reported
Susepythonrpmlinux enterprise desktop 12 sp42.7.13-28.16.1Not reportedSUSE-SU-2018:3554-2Not reported
Susepython-baserpmlinux enterprise desktop 12 sp42.7.13-28.16.1Not reportedSUSE-SU-2018:3554-2Not reported
Susepython-baserpmlinux enterprise software development kit 12 sp42.7.13-28.16.1Not reportedSUSE-SU-2018:3554-2Not reported
Susepythonrpmlinux enterprise server 12 sp42.7.13-28.16.1Not reportedSUSE-SU-2018:3554-2Not reported
Susepython-baserpmlinux enterprise server 12 sp42.7.13-28.16.1Not reportedSUSE-SU-2018:3554-2Not reported
Susepython-docrpmlinux enterprise server 12 sp42.7.13-28.16.1Not reportedSUSE-SU-2018:3554-2Not reported
Susepythonrpmlinux enterprise server for sap applications 12 sp42.7.13-28.16.1Not reportedSUSE-SU-2018:3554-2Not reported
Susepython-baserpmlinux enterprise server for sap applications 12 sp42.7.13-28.16.1Not reportedSUSE-SU-2018:3554-2Not reported
Susepython-docrpmlinux enterprise server for sap applications 12 sp42.7.13-28.16.1Not reportedSUSE-SU-2018:3554-2Not reported
Susepython-baserpmlinux enterprise workstation extension 12 sp42.7.13-28.16.1Not reportedSUSE-SU-2018:3554-2Not reported
Susepython3rpmhpe helion openstack 83.4.6-25.29.1Not reportedSUSE-SU-2019:2053-2Not reported
Susepython3-baserpmhpe helion openstack 83.4.6-25.29.1Not reportedSUSE-SU-2019:2053-2Not reported
Susepython3rpmopenstack cloud crowbar 83.4.6-25.29.1Not reportedSUSE-SU-2019:2053-2Not reported
Susepython3-baserpmopenstack cloud crowbar 83.4.6-25.29.1Not reportedSUSE-SU-2019:2053-2Not reported
Susepython3rpmlinux enterprise server 12 sp3-ltss3.4.6-25.29.1Not reportedSUSE-SU-2019:2053-2Not reported
Susepython3-baserpmlinux enterprise server 12 sp3-ltss3.4.6-25.29.1Not reportedSUSE-SU-2019:2053-2Not reported
Susepython3rpmlinux enterprise server 12 sp3-bcl3.4.6-25.29.1Not reportedSUSE-SU-2019:2053-2Not reported
Susepython3-baserpmlinux enterprise server 12 sp3-bcl3.4.6-25.29.1Not reportedSUSE-SU-2019:2053-2Not reported
Susepython3rpmenterprise storage 53.4.6-25.29.1Not reportedSUSE-SU-2019:2053-2Not reported
Susepython3-baserpmenterprise storage 53.4.6-25.29.1Not reportedSUSE-SU-2019:2053-2Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References