CVE-2013-7323

Description

python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.

How to fix CVE-2013-7323

To remediate CVE-2013-7323, upgrade the affected package to a fixed version below.

• Debian/python-gnupg—upgrade to 0.3.6-1 or later
• Debian/python-gnupg—upgrade to 0.3.6-1~deb7u1 or later
• —upgrade to 0.3.7 or later
• —upgrade to 0.3.5 or later

Is CVE-2013-7323 being exploited?

Low — EPSS is 1.2%, meaning exploitation activity has not been observed at scale.

Affected packages (4)

• from 0, < 0.3.6-1
• from 0, < 0.3.6-1~deb7u1
• from 0, < 0.3.7
• from 0, < 0.3.5

CVSS scores

References (13)

• ADVISORYsecunia.com/advisories/56616
• ADVISORYsecunia.com/advisories/59031
• ADVISORYgithub.com/advisories/GHSA-c2fx-8r76-gh36
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2013-7323
• ADVISORYsecurity-tracker.debian.org