PatchTheCVECVE-2014-1928: The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-depen
CVE-2014-1928 is a medium-severity flaw (CVSS 4.6) affecting python-gnupg. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "\" (backslash) characters to form multi-command sequences, a different vulnerability than CVE-2014-1927. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.6 (Medium) |
| EPSS exploit chance | 0.6% (top 51%) |
| CISA exploited list | No |
| Weakness | CWE-20 |
| Published | 2014-10-25 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2014-1928?
python-gnupg: upgrade to newer than 0.3.5. Exact commands for each OS are on this page.
Is CVE-2014-1928 being exploited?
CVE-2014-1928 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2014-1928 affect?
CVE-2014-1928 affects python-gnupg. Severity is medium (CVSS 4.6). The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "\" (backslash) ch
How urgent is CVE-2014-1928?
Priority 33/100. Public exploit reference
Software pages
Python vulnerabilities · GnuPG vulnerabilities
Related CVEs
- CVE-2019-6690 HIGH 7.5 DOWNGRADE MITIGATE python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended
- CVE-2014-1929 MEDIUM 4.4 DOWNGRADE python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors rela
- CVE-2014-1927 HIGH 7.5 DOWNGRADE The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent
- CVE-2013-7323 HIGH 7.5 UPGRADE python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metachara