CVE-2007-0404

Description

bin/compile-messages.py in Django 0.95 does not quote argument strings before invoking the msgfmt program through the os.system function, which allows attackers to execute arbitrary commands via shell metacharacters in a (1) .po or (2) .mo file.

How to fix CVE-2007-0404

To remediate CVE-2007-0404, upgrade the affected package to a fixed version below.

• PyPI/django—upgrade to 1.0 or later
• PyPI/django—upgrade to 1.0 or later

Is CVE-2007-0404 being exploited?

Low — EPSS is 1.6%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• >= 0.95, < 1.0
• >= 0.95, < 1.0

References (9)

• ADVISORYgithub.com/advisories/GHSA-qc99-g3wm-hgxr
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2007-0404
• PATCHgithub.com/django/django
• PATCHpypi.org/project/django
• WEBcode.djangoproject.com/changeset/3592