CVE-2018-1000802: Command Injection
Last updated 25 August 2025
Other sources
Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (makearchive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1000802?
CVE-2018-1000802 is considered a medium-severity vulnerability that can lead to command injection and denial of service.
How do I fix CVE-2018-1000802?
To fix CVE-2018-1000802, update Python to version 2.7.18 or later where the vulnerability has been patched.
What versions of Python are affected by CVE-2018-1000802?
CVE-2018-1000802 affects all versions of Python 2.7 up to 2.7.16.
Can CVE-2018-1000802 lead to information disclosure?
Yes, CVE-2018-1000802 can potentially lead to information disclosure through command injection vulnerabilities.
What function in Python is associated with CVE-2018-1000802?
The vulnerability in CVE-2018-1000802 is located in the shutil module, specifically the make_archive function.