CVE-2014-1929

python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection through positional arguments." NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.

Published Bycve@mitre.org

Published DateOct 25, 2014, 21:55

Affected Versions(1)

python-gnupg(PyPI)

Introduced0.3.5

Fixed0.3.7

LimitN/A

Package (Ecosystem)	Introduced	Fixed	Limit
python-gnupg(PyPI)	0.3.5	0.3.7	N/A

Weakness Type (CWE):CWE-20

CVSS Metrics

Base Score

4.4

Vector String

AV:L/AC:M/Au:N/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL

References

Weakness Type (CWE):CWE-20

CVSS Metrics

Base Score

4.4

Vector String

AV:L/AC:M/Au:N/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL