Re: CVE request: python-gnupg before 0.3.5 shell injection

[cve-assign () mitre org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> Second, 0.3.5 and 0.3.6 have a series of differences in handling of
> command-line arguments. This seems to be most likely a reaction to
> Florian Weimer's observation of "you need to make sure that you
> prevent option injection through positional arguments." Does anyone
> believe that option injection was impossible in 0.3.5? If not, we will
> make a fourth CVE assignment.

Use CVE-2014-1929.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJS+57hAAoJEKllVAevmvmshgoH/i9CI0xncK8FfQE2t8dA96Cc
3u94LLYzD+hqLMKSuNdArk7ekx00M/53p6ntFqff+neZWGLqVteo4ZPUFspWIv0W
P7u1GWAMZl75KamqgRXrcp5mPbE5axe7FrEW0Z3Wd0PdT4xWMa9GUALypqGrOYNr
zHehk+eLhqqapD4Z2xBFDjMEAzHobTeOHXP7tOL7e7+ut3UMmGAlG/i6FIBn3XKq
/X2mHQ8EykDyb09oyih20NuttOtNr9aOkTJyODJK6Yqdr7gPu3tD3TVogqYvYNRm
qwPZZLfEqvH4rlMsua/exySvQSMp+eOl+NJ720YRU8XPRzZGzxqZguaayAryT+U=
=Pt+A
-----END PGP SIGNATURE-----