crítica
CVE-2015-8557
python-pygments: Shell injection in FontManager._get_nix_font_path
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.0CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
GHSA9.5CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Red Hat5.1AV:N/AC:H/Au:N/C:P/I:P/A:P
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA. Más baja según Amazon (alta), Red Hat (media), Ubuntu (media).
Descripción
The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| pip::GitHub Security Advisory pip | pygments | 2.1 |
| amazon linux 1 | python26-pygments, python27-pygments | 1.4-4.12.amzn1 |
| debian 11 | pygments | 2.0.1+dfsg-2 |
| debian 12 | pygments | 2.0.1+dfsg-2 |
| debian 13 | pygments | 2.0.1+dfsg-2 |
| debian 14 | pygments | 2.0.1+dfsg-2 |
| debian 7 | pygments | 1.5+dfsg-1+deb7u1 |
| debian 8 | pygments | 2.0.1+dfsg-1.1+deb8u1 |
| echo | pygments | 2.0.1+dfsg-2 |
| Red Hat | python-pygments, python27-python-pygments, python33-python-pygments y 1 más | sin corrección indicada |
| ubuntu 12.04 | pygments | 1.4+dfsg-2ubuntu0.1 |
| ubuntu 14.04 | pygments | 1.6+dfsg-1ubuntu1.1 |
Mostrar las 19 entradas de 15 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| pip::GitHub Security Advisory pip | pygments | 2.1 |
| amazon linux 1 | python26-pygments | 1.4-4.12.amzn1 |
| amazon linux 1 | python27-pygments | 1.4-4.12.amzn1 |
| debian 11 | pygments | 2.0.1+dfsg-2 |
| debian 12 | pygments | 2.0.1+dfsg-2 |
| debian 13 | pygments | 2.0.1+dfsg-2 |
| debian 14 | pygments | 2.0.1+dfsg-2 |
| debian 7 | pygments | 1.5+dfsg-1+deb7u1 |
| debian 8 | pygments | 2.0.1+dfsg-1.1+deb8u1 |
| echo | pygments | 2.0.1+dfsg-2 |
| Red Hat | python-pygments | sin corrección indicada |
| Red Hat | python27-python-pygments | sin corrección indicada |
| Red Hat | python33-python-pygments | sin corrección indicada |
| Red Hat | rh-python34-python-pygments | sin corrección indicada |
| ubuntu 12.04 | pygments | 1.4+dfsg-2ubuntu0.1 |
| ubuntu 14.04 | pygments | 1.6+dfsg-1ubuntu1.1 |
| ubuntu 14.04-ESM | pygments | 1.6+dfsg-1ubuntu1.1 |
| ubuntu 15.04 | pygments | 2.0.1+dfsg-1svn1.1 |
| ubuntu 15.10 | pygments | 2.0.1+dfsg-1.1svn1.1 |
Referencias
- http://packetstormsecurity.com/files/133823/Pygments-FontManager._get_nix_font_path-Shell-Injection.html
- http://seclists.org/fulldisclosure/2015/Oct/4
- http://www.debian.org/security/2016/dsa-3445
- http://www.openwall.com/lists/oss-security/2015/12/14/17
- http://www.openwall.com/lists/oss-security/2015/12/14/6
- http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
- http://www.ubuntu.com/usn/USN-2862-1
- https://access.redhat.com/security/cve/CVE-2015-8557
Las 17 referencias
- https://bitbucket.org/birkenfeld/pygments-main/pull-requests/501/fix-shell-injection-in/diff
- https://github.com/advisories/GHSA-fff8-4w9p-7v76
- https://github.com/pygments/pygments
- https://github.com/pygments/pygments/commit/db6dd826f8624179e563aaded391efe824462f51
- https://github.com/pypa/advisory-database/tree/main/vulns/pygments/PYSEC-2016-32.yaml
- https://nvd.nist.gov/vuln/detail/CVE-2015-8557
- https://security.gentoo.org/glsa/201612-05
- https://ubuntu.com/security/notices/USN-2862-1
- https://www.cve.org/CVERecord?id=CVE-2015-8557