—

PYSEC-2016-32

Quick fix

PYSEC-2016-32 — pygments: upgrade to the fixed version with the command below.

pip install --upgrade 'pygments>=2.1'

Details

The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/pygments

Introduced in: 1.2.2Fixed in: 2.1

Fixpip install --upgrade 'pygments>=2.1'

References

http://packetstormsecurity.com/files/133823/Pygments-FontManager._get_nix_font_path-Shell-Injection.html[WEB]
http://www.openwall.com/lists/oss-security/2015/12/14/6[WEB]
http://seclists.org/fulldisclosure/2015/Oct/4[WEB]
http://www.ubuntu.com/usn/USN-2862-1[ADVISORY]
https://bitbucket.org/birkenfeld/pygments-main/pull-requests/501/fix-shell-injection-in/diff[WEB]
http://www.openwall.com/lists/oss-security/2015/12/14/17[WEB]
http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html[WEB]
http://www.debian.org/security/2016/dsa-3445[ADVISORY]
https://security.gentoo.org/glsa/201612-05[ADVISORY]
https://github.com/advisories/GHSA-fff8-4w9p-7v76[ADVISORY]