{"id":"CVE-2018-1000802","aliases":["DEBIAN-CVE-2018-1000802","DLA-1519-1","DLA-1520-1","DSA-4306-1","EUVD-2018-2006","GHSA-grfr-pqc4-fqmw","MGASA-2018-0495","SUSE-SU-2018:3002-1","SUSE-SU-2018:3554-1","SUSE-SU-2018:3554-2","SUSE-SU-2019:2053-1","SUSE-SU-2019:2053-2","SUSE-SU-2020:0114-1","SUSE-SU-2020:0234-1","SUSE-SU-2020:0302-1","UBUNTU-CVE-2018-1000802","USN-3817-1","openSUSE-SU-2020:0086-1","openSUSE-SU-2024:11202-1","openSUSE-SU-2024:11284-1"],"status":"published","title":"Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper...","description":"Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.20126,"percentile":0.97472,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-77"],"published":"2018-09-18T00:00:00Z","modified":"2026-10-20T10:49:57Z","exploits":[{"source":"pocgithub","id":"tna0y/CVE-2018-1000802-PoC","title":"tna0y/CVE-2018-1000802-PoC","date":"2018-09-14","url":"https://github.com/tna0y/CVE-2018-1000802-PoC"}],"fixes":[{"ecosystem":"Debian:11","package":"python2.7","fixed_in":["2.7.15-5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"python","fixed_in":["2.7.14-7.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"python-base","fixed_in":["2.7.14-7.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"python","fixed_in":["2.7.14-7.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"python2.7","fixed_in":["2.7.6-8ubuntu0.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"python3.4","fixed_in":["3.4.3-1ubuntu1~14.04.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"python2.7","fixed_in":["2.7.12-1ubuntu0~16.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"python2.7","fixed_in":["2.7.15~rc1-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"python2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.15-5"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"python2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.9-2+deb8u2"}]}],"versions":["2.7.9-2","2.7.9-2+deb8u1"],"bundled":4},{"source":"osv","ecosystem":"Debian:8","package":"python3.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-1+deb8u1"}]}],"versions":["3.4.2-1"],"bundled":4},{"source":"osv","ecosystem":"Debian:9","package":"python2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.13-2+deb9u3"}]}],"versions":["2.7.13-2","2.7.13-2+deb9u1","2.7.13-2+deb9u2"],"bundled":4},{"source":"osv","ecosystem":"Mageia:6","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.15-1.1.mga6"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.14-7.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"python-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.14-7.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.14-7.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.13-28.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"python-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.13-28.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"python-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.13-28.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.13-28.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"python-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.13-28.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"python-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.13-28.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.13-28.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"python-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.13-28.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"python-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.13-28.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"python-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.13-28.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.13-28.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.13-28.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"python-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.13-28.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"python-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.13-28.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.13-28.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"python-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.13-28.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"python-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.13-28.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.13-28.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"python-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.13-28.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"python-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.13-28.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP4","package":"python-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.13-28.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-25.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.10-3.42.2"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.10-3.42.2"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.10-3.42.2"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.10-3.42.2"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.10-3.42.2"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP1","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.10-3.42.2"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.17-7.32.2"}]}],"bundled":37},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"python-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.17-7.32.1"}]}],"bundled":37},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.17-7.32.2"}]}],"bundled":37},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"python-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.17-7.32.1"}]}],"bundled":37},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.17-7.32.2"}]}],"bundled":37},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP1","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.17-7.32.2"}]}],"bundled":37},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 2 15 SP1","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.17-7.32.2"}]}],"bundled":37},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 2 15 SP1","package":"python-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.17-7.32.1"}]}],"bundled":37},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"python36","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.10-4.3.5"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"python36-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.10-4.3.5"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"python36","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.10-4.3.5"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"python36-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.10-4.3.5"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-8ubuntu0.5"}]}],"versions":["2.7.5-8ubuntu3","2.7.5-8ubuntu4","2.7.6-2","2.7.6-2ubuntu1","2.7.6-3","2.7.6-3ubuntu1","2.7.6-4","2.7.6-4ubuntu1","2.7.6-5","2.7.6-7","2.7.6-8","2.7.6-8ubuntu0.2","2.7.6-8ubuntu0.3","2.7.6-8ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python3.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-1ubuntu1~14.04.7"}]}],"versions":["3.4~b1-0ubuntu3","3.4~b1-4ubuntu4","3.4~b1-4ubuntu6","3.4~b1-5ubuntu2","3.4~b2-1","3.4~b3-1ubuntu1","3.4~rc1-1build1","3.4~rc2-1","3.4~rc3-0ubuntu1","3.4.0-1","3.4.0-2ubuntu1","3.4.0-2ubuntu1.1","3.4.3-1ubuntu1~14.04.1","3.4.3-1ubuntu1~14.04.3","3.4.3-1ubuntu1~14.04.4","3.4.3-1ubuntu1~14.04.5","3.4.3-1ubuntu1~14.04.6"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.12-1ubuntu0~16.04.4"}]}],"versions":["2.7.10-4ubuntu1","2.7.10-4ubuntu2","2.7.11-2","2.7.11-3","2.7.11-4","2.7.11-6","2.7.11-7","2.7.11-7ubuntu1","2.7.12-1~16.04","2.7.12-1ubuntu0~16.04.1","2.7.12-1ubuntu0~16.04.2","2.7.12-1ubuntu0~16.04.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.15~rc1-1ubuntu0.1"}]}],"versions":["2.7.14-2ubuntu2","2.7.14-4","2.7.14-6","2.7.14-7","2.7.14-8","2.7.15~rc1-1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-8ubuntu0.5"}]}],"versions":["2.7.5-8ubuntu3","2.7.5-8ubuntu4","2.7.6-2","2.7.6-2ubuntu1","2.7.6-3","2.7.6-3ubuntu1","2.7.6-4","2.7.6-4ubuntu1","2.7.6-5","2.7.6-7","2.7.6-8","2.7.6-8ubuntu0.2","2.7.6-8ubuntu0.3","2.7.6-8ubuntu0.4"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python3.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-1ubuntu1~14.04.7"}]}],"versions":["3.4~b1-0ubuntu3","3.4~b1-4ubuntu4","3.4~b1-4ubuntu6","3.4~b1-5ubuntu2","3.4~b2-1","3.4~b3-1ubuntu1","3.4~rc1-1build1","3.4~rc2-1","3.4~rc3-0ubuntu1","3.4.0-1","3.4.0-2ubuntu1","3.4.0-2ubuntu1.1","3.4.3-1ubuntu1~14.04.1","3.4.3-1ubuntu1~14.04.3","3.4.3-1ubuntu1~14.04.4","3.4.3-1ubuntu1~14.04.5","3.4.3-1ubuntu1~14.04.6"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.12-1ubuntu0~16.04.4"}]}],"versions":["2.7.10-4ubuntu1","2.7.10-4ubuntu2","2.7.11-2","2.7.11-3","2.7.11-4","2.7.11-6","2.7.11-7","2.7.11-7ubuntu1","2.7.12-1~16.04","2.7.12-1ubuntu0~16.04.1","2.7.12-1ubuntu0~16.04.2","2.7.12-1ubuntu0~16.04.3"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python3.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-2ubuntu0~16.04.5"}]}],"versions":["3.5.0-3","3.5.0-3ubuntu1","3.5.1~rc1-2ubuntu1","3.5.1-1","3.5.1-2","3.5.1-3","3.5.1-5","3.5.1-6ubuntu1","3.5.1-6ubuntu2","3.5.1-9ubuntu1","3.5.1-10","3.5.2-2~16.01","3.5.2-2~16.04","3.5.2-2ubuntu0~16.04.1","3.5.2-2ubuntu0~16.04.2","3.5.2-2ubuntu0~16.04.3","3.5.2-2ubuntu0~16.04.4"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.15~rc1-1ubuntu0.1"}]}],"versions":["2.7.14-2ubuntu2","2.7.14-4","2.7.14-6","2.7.14-7","2.7.14-8","2.7.15~rc1-1"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.10-lp151.6.7.1"}]}],"bundled":26},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.10-lp151.6.7.1"}]}],"bundled":26},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-8.1"}]}],"bundled":40},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python36","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-1.1"}]}],"bundled":39}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"opensuse","product":"leap"},{"vendor":"python","product":"python"}],"references":[{"url":"https://www.debian.org/security/2018/dsa-4306","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/3817-2/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/python/cpython/pull/8985/commits/add531a1e55b0a739b0f42582f1c9747e5649ace","tags":["x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://mega.nz/#%21JUFiCC4R%21mq-jQ8ySFwIhX6WMDujaZuNBfttDVt7DETlfOIQE1ig","tags":["x_transferred","web"]},{"url":"https://github.com/python/cpython/pull/8985","tags":["x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://usn.ubuntu.com/3817-1/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugs.python.org/issue34540","tags":["x_transferred","Issue Tracking","Patch","Vendor Advisory","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20230309-0002/","tags":["x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000802"},{"url":"https://mega.nz/#!JUFiCC4R!mq-jQ8ySFwIhX6WMDujaZuNBfttDVt7DETlfOIQE1ig","tags":["report"]},{"url":"https://security.netapp.com/advisory/ntap-20230309-0002"},{"url":"https://usn.ubuntu.com/3817-1"},{"url":"https://usn.ubuntu.com/3817-2"},{"url":"https://github.com/advisories/GHSA-grfr-pqc4-fqmw"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-1000802","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0495.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23061","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-04/msg00041.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/O4ERR26C7JCSELMELHCVZ5TZXFKHBJ72/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/HFL5UURGWQ53IKGPTD7B4MKMSMUZPTGU/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183002-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1109663","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000802","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183554-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1086001","tags":["report"]},{"url":"https://bugzilla.suse.com/1088004","tags":["report"]},{"url":"https://bugzilla.suse.com/1088009","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1061","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183554-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192053-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1109847","tags":["report"]},{"url":"https://bugzilla.suse.com/1138459","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10160","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192053-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200114-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1027282","tags":["report"]},{"url":"https://bugzilla.suse.com/1029377","tags":["report"]},{"url":"https://bugzilla.suse.com/1029902","tags":["report"]},{"url":"https://bugzilla.suse.com/1040164","tags":["report"]},{"url":"https://bugzilla.suse.com/1042670","tags":["report"]},{"url":"https://bugzilla.suse.com/1070853","tags":["report"]},{"url":"https://bugzilla.suse.com/1079761","tags":["report"]},{"url":"https://bugzilla.suse.com/1081750","tags":["report"]},{"url":"https://bugzilla.suse.com/1083507","tags":["report"]},{"url":"https://bugzilla.suse.com/1088573","tags":["report"]},{"url":"https://bugzilla.suse.com/1094814","tags":["report"]},{"url":"https://bugzilla.suse.com/1107030","tags":["report"]},{"url":"https://bugzilla.suse.com/1120644","tags":["report"]},{"url":"https://bugzilla.suse.com/1122191","tags":["report"]},{"url":"https://bugzilla.suse.com/1129346","tags":["report"]},{"url":"https://bugzilla.suse.com/1130840","tags":["report"]},{"url":"https://bugzilla.suse.com/1133452","tags":["report"]},{"url":"https://bugzilla.suse.com/1137942","tags":["report"]},{"url":"https://bugzilla.suse.com/1141853","tags":["report"]},{"url":"https://bugzilla.suse.com/1149121","tags":["report"]},{"url":"https://bugzilla.suse.com/1149792","tags":["report"]},{"url":"https://bugzilla.suse.com/1149955","tags":["report"]},{"url":"https://bugzilla.suse.com/1151490","tags":["report"]},{"url":"https://bugzilla.suse.com/1153238","tags":["report"]},{"url":"https://bugzilla.suse.com/1159035","tags":["report"]},{"url":"https://bugzilla.suse.com/1159622","tags":["report"]},{"url":"https://bugzilla.suse.com/637176","tags":["report"]},{"url":"https://bugzilla.suse.com/658604","tags":["report"]},{"url":"https://bugzilla.suse.com/673071","tags":["report"]},{"url":"https://bugzilla.suse.com/709442","tags":["report"]},{"url":"https://bugzilla.suse.com/743787","tags":["report"]},{"url":"https://bugzilla.suse.com/747125","tags":["report"]},{"url":"https://bugzilla.suse.com/751718","tags":["report"]},{"url":"https://bugzilla.suse.com/754447","tags":["report"]},{"url":"https://bugzilla.suse.com/754677","tags":["report"]},{"url":"https://bugzilla.suse.com/787526","tags":["report"]},{"url":"https://bugzilla.suse.com/809831","tags":["report"]},{"url":"https://bugzilla.suse.com/831629","tags":["report"]},{"url":"https://bugzilla.suse.com/834601","tags":["report"]},{"url":"https://bugzilla.suse.com/871152","tags":["report"]},{"url":"https://bugzilla.suse.com/885662","tags":["report"]},{"url":"https://bugzilla.suse.com/885882","tags":["report"]},{"url":"https://bugzilla.suse.com/917607","tags":["report"]},{"url":"https://bugzilla.suse.com/942751","tags":["report"]},{"url":"https://bugzilla.suse.com/951166","tags":["report"]},{"url":"https://bugzilla.suse.com/983582","tags":["report"]},{"url":"https://bugzilla.suse.com/984751","tags":["report"]},{"url":"https://bugzilla.suse.com/985177","tags":["report"]},{"url":"https://bugzilla.suse.com/985348","tags":["report"]},{"url":"https://bugzilla.suse.com/989523","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1000110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9947","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200234-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1041090","tags":["report"]},{"url":"https://bugzilla.suse.com/1068664","tags":["report"]},{"url":"https://bugzilla.suse.com/1073269","tags":["report"]},{"url":"https://bugzilla.suse.com/1073748","tags":["report"]},{"url":"https://bugzilla.suse.com/1078326","tags":["report"]},{"url":"https://bugzilla.suse.com/1078485","tags":["report"]},{"url":"https://bugzilla.suse.com/1079300","tags":["report"]},{"url":"https://bugzilla.suse.com/1084650","tags":["report"]},{"url":"https://bugzilla.suse.com/1111793","tags":["report"]},{"url":"https://bugzilla.suse.com/1113755","tags":["report"]},{"url":"https://bugzilla.suse.com/1130847","tags":["report"]},{"url":"https://bugzilla.suse.com/1153830","tags":["report"]},{"url":"https://bugzilla.suse.com/214983","tags":["report"]},{"url":"https://bugzilla.suse.com/298378","tags":["report"]},{"url":"https://bugzilla.suse.com/346490","tags":["report"]},{"url":"https://bugzilla.suse.com/367853","tags":["report"]},{"url":"https://bugzilla.suse.com/379534","tags":["report"]},{"url":"https://bugzilla.suse.com/380942","tags":["report"]},{"url":"https://bugzilla.suse.com/399190","tags":["report"]},{"url":"https://bugzilla.suse.com/406051","tags":["report"]},{"url":"https://bugzilla.suse.com/425138","tags":["report"]},{"url":"https://bugzilla.suse.com/426563","tags":["report"]},{"url":"https://bugzilla.suse.com/430761","tags":["report"]},{"url":"https://bugzilla.suse.com/432677","tags":["report"]},{"url":"https://bugzilla.suse.com/436966","tags":["report"]},{"url":"https://bugzilla.suse.com/437293","tags":["report"]},{"url":"https://bugzilla.suse.com/441088","tags":["report"]},{"url":"https://bugzilla.suse.com/462375","tags":["report"]},{"url":"https://bugzilla.suse.com/525295","tags":["report"]},{"url":"https://bugzilla.suse.com/534721","tags":["report"]},{"url":"https://bugzilla.suse.com/551715","tags":["report"]},{"url":"https://bugzilla.suse.com/572673","tags":["report"]},{"url":"https://bugzilla.suse.com/577032","tags":["report"]},{"url":"https://bugzilla.suse.com/581765","tags":["report"]},{"url":"https://bugzilla.suse.com/603255","tags":["report"]},{"url":"https://bugzilla.suse.com/617751","tags":["report"]},{"url":"https://bugzilla.suse.com/638233","tags":["report"]},{"url":"https://bugzilla.suse.com/682554","tags":["report"]},{"url":"https://bugzilla.suse.com/697251","tags":["report"]},{"url":"https://bugzilla.suse.com/707667","tags":["report"]},{"url":"https://bugzilla.suse.com/718009","tags":["report"]},{"url":"https://bugzilla.suse.com/747794","tags":["report"]},{"url":"https://bugzilla.suse.com/766778","tags":["report"]},{"url":"https://bugzilla.suse.com/794139","tags":["report"]},{"url":"https://bugzilla.suse.com/804978","tags":["report"]},{"url":"https://bugzilla.suse.com/827982","tags":["report"]},{"url":"https://bugzilla.suse.com/831442","tags":["report"]},{"url":"https://bugzilla.suse.com/836739","tags":["report"]},{"url":"https://bugzilla.suse.com/856835","tags":["report"]},{"url":"https://bugzilla.suse.com/856836","tags":["report"]},{"url":"https://bugzilla.suse.com/857470","tags":["report"]},{"url":"https://bugzilla.suse.com/863741","tags":["report"]},{"url":"https://bugzilla.suse.com/898572","tags":["report"]},{"url":"https://bugzilla.suse.com/901715","tags":["report"]},{"url":"https://bugzilla.suse.com/935856","tags":["report"]},{"url":"https://bugzilla.suse.com/945401","tags":["report"]},{"url":"https://bugzilla.suse.com/964182","tags":["report"]},{"url":"https://bugzilla.suse.com/997436","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2007-2052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-2315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-2316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-3142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-3143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-3144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9948","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200302-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1149429","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-1000802","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3817-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3817-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000802","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-1060","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-1061","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14647","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-1000030","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SRKGGFVSV7DDWCMAOSO6E3F66U2CF5XR/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14422","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3426","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-1000802","description":"Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.","status":"published","published":"2018-09-18T00:00:00Z","modified":"2026-10-08T21:03:31.39Z","updated_at":"2026-11-02T14:35:10.685174Z"}],"euvd":[{"id":"EUVD-2018-2006","description":"Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.","status":"published","published":"2018-09-18T00:00:00Z","modified":"2026-10-08T21:03:31Z","updated_at":"2026-11-02T17:27:26.856493Z"}],"ghsa":[{"id":"GHSA-grfr-pqc4-fqmw","title":"Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper...","description":"Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.","status":"published","published":"2022-05-13T01:12:21Z","modified":"2026-10-08T21:33:19Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:12:57.86261Z"}],"nvd":[{"id":"CVE-2018-1000802","description":"Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.","status":"published","published":"2018-09-18T17:29:00.88Z","modified":"2026-10-08T21:17:06.73Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:04:40.661264Z"}],"osv":[{"id":"CVE-2018-1000802","description":"Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.","status":"published","published":"2018-09-18T17:29:00.88Z","modified":"2026-10-20T10:49:57.298541219Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:07.641418Z"},{"id":"DEBIAN-CVE-2018-1000802","description":"Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.","status":"published","published":"2018-09-18T17:29:00.88Z","modified":"2026-08-04T06:04:18.926504975Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"UBUNTU-CVE-2018-1000802","description":"Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.","status":"published","published":"2018-09-18T00:00:00Z","modified":"2026-04-22T11:39:28.299383Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"DLA-1519-1","title":"python2.7 - security update","status":"published","published":"2018-09-25T00:00:00Z","modified":"2026-03-09T01:02:00.77833Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-1520-1","title":"python3.4 - security update","status":"published","published":"2018-09-25T00:00:00Z","modified":"2026-03-09T01:22:08.926252Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4306-1","title":"python2.7 - security update","status":"published","published":"2018-09-27T00:00:00Z","modified":"2026-03-09T02:10:21.400458Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2018-0495","title":"Updated python packages fix security vulnerabilities","description":"Possible denial of service vulnerability due to a missing check in\nLib/wave.py to verify that at least one channel is provided\n(CVE-2017-18207).\n\nPython's elementtree C accelerator failed to initialise Expat's hash\nsalt during initialization. This could make it easy to conduct denial of\nservice attacks against Expat by contructing an XML document that would\ncause pathological hash collisions in Expat's internal data structures,\nconsuming large amounts CPU and RAM (CVE-2018-14647).\n\nIt was discovered that the shutil module of python does not properly\nsanitize input when creating a zip file on Windows. An attacker could\nuse this flaw to cause a denial of service or add unintended files to\nthe generated archive (CVE-2018-1000802).\n","status":"published","published":"2018-12-31T22:42:09Z","modified":"2026-04-16T06:25:20.771600807Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2020:0086-1","title":"Security update for python3","description":"This update for python3 to version 3.6.10 fixes the following issues:\n\n- CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507).\n- CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ (bsc#1149955).\n- CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-01-21T15:12:01Z","modified":"2026-02-04T04:15:12.498924Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:11202-1","title":"python-2.7.18-8.1 on GA media","description":"These are all security issues fixed in the python-2.7.18-8.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:22.875083Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:11284-1","title":"python36-3.6.15-1.1 on GA media","description":"These are all security issues fixed in the python36-3.6.15-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:26:32.95982Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2018:3002-1","title":"Security update for python","description":"This update for python fixes the following issue:\n\n- CVE-2018-1000802: Prevent command injection in shutil module (make_archive\n  function) via passage of unfiltered user input (bsc#1109663)\n","status":"published","published":"2018-10-04T12:17:50Z","modified":"2026-02-04T04:39:32.07346Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:3554-1","title":"Security update for python, python-base","description":"This update for python, python-base fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-1000802: Prevent command injection in shutil module (make_archive\n  function) via passage of unfiltered user input (bsc#1109663).\n- CVE-2018-1061: Fixed DoS via regular expression backtracking in\n  difflib.IS_LINE_JUNK method in difflib (bsc#1088004).\n- CVE-2018-1060: Fixed DoS via regular expression catastrophic backtracking in\n  apop() method in pop3lib (bsc#1088009).\n\nBug fixes:\n\n- bsc#1086001: python tarfile uses random order.\n","status":"published","published":"2018-10-29T16:29:09Z","modified":"2026-02-04T04:38:09.180504Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:3554-2","title":"Security update for python, python-base","description":"This update for python, python-base fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-1000802: Prevent command injection in shutil module (make_archive\n  function) via passage of unfiltered user input (bsc#1109663).\n- CVE-2018-1061: Fixed DoS via regular expression backtracking in\n  difflib.IS_LINE_JUNK method in difflib (bsc#1088004).\n- CVE-2018-1060: Fixed DoS via regular expression catastrophic backtracking in\n  apop() method in pop3lib (bsc#1088009).\n\nBug fixes:\n\n- bsc#1086001: python tarfile uses random order.\n","status":"published","published":"2018-12-10T13:04:38Z","modified":"2026-02-04T04:17:13.10374Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2019:2053-1","title":"Security update for python3","description":"This update for python3 fixes the following issues:\n\n- CVE-2019-10160: Fixed a regression in urlparse() and urlsplit() introduced by the fix for CVE-2019-9636 (bsc#1138459).\n- CVE-2018-14647: Fixed a denial of service vulnerability caused by a crafted XML document (bsc#1109847).\n- CVE-2018-1000802: Fixed a command injection in the shutil module (bsc#1109663).\n","status":"published","published":"2019-08-06T07:45:52Z","modified":"2026-02-04T04:21:51.356295Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2053-2","title":"Security update for python3","description":"This update for python3 fixes the following issues:\n\n- CVE-2019-10160: Fixed a regression in urlparse() and urlsplit() introduced by the fix for CVE-2019-9636 (bsc#1138459).\n- CVE-2018-14647: Fixed a denial of service vulnerability caused by a crafted XML document (bsc#1109847).\n- CVE-2018-1000802: Fixed a command injection in the shutil module (bsc#1109663).\n","status":"published","published":"2019-08-06T07:45:52Z","modified":"2026-02-04T03:46:02.091772Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2020:0114-1","title":"Security update for python3","description":"This update for python3 to version 3.6.10 fixes the following issues:\n\n- CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507).\n- CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ (bsc#1149955).\n- CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429).\n","status":"published","published":"2020-01-16T09:12:11Z","modified":"2026-02-04T02:55:36.328023Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0234-1","title":"Security update for python","description":"This update for python fixes the following issues:\n\nUpdated to version 2.7.17 to unify packages among openSUSE:Factory and SLE versions (bsc#1159035).\n","status":"published","published":"2020-01-24T15:34:18Z","modified":"2025-05-02T04:03:47.841058Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0302-1","title":"Security update for python36","description":"This update for python36 to version 3.6.10 fixes the following issues:\n\n- CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507).\n- CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ signs (bsc#1149955).\n- CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429).\n","status":"published","published":"2020-02-03T13:35:40Z","modified":"2026-02-04T04:39:44.509955Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"USN-3817-1","title":"python2.7, python3.4, python3.5 vulnerabilities","description":"It was discovered that Python incorrectly handled large amounts of data. A\nremote attacker could use this issue to cause Python to crash, resulting in\na denial of service, or possibly execute arbitrary code. This issue only\naffected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2018-1000030)\n\nIt was discovered that Python incorrectly handled running external commands\nin the shutil module. A remote attacker could use this issue to cause\nPython to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2018-1000802)\n\nIt was discovered that Python incorrectly used regular expressions\nvulnerable to catastrophic backtracking. A remote attacker could possibly\nuse this issue to cause a denial of service. This issue only affected\nUbuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2018-1060, CVE-2018-1061)\n\nIt was discovered that Python failed to initialize Expat's hash salt. A\nremote attacker could possibly use this issue to cause hash collisions,\nleading to a denial of service. (CVE-2018-14647)\n","status":"published","published":"2018-11-13T15:40:04Z","modified":"2026-04-22T09:51:59.659195Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}