python-sh - Debian Package Tracker

general

source: python-sh (main)
version: 2.2.1-2
maintainer: Debian Python Team (DMD)
uploaders: Sam Hartman [DMD] – Paul Tagliamonte [DMD] – Tianon Gravi [DMD]
arch: all
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.14.1-1
oldstable: 1.14.2-1
stable: 2.2.1-1
testing: 2.2.1-2
unstable: 2.2.1-2

versioned links

1.14.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.14.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.2.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.2.1-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

python3-sh

action needed

A new upstream version is available: 2.4.0 high

A new upstream version 2.4.0 is available, you should consider packaging it.

Created: 2025-11-26 Last update: 2026-09-08 10:01

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-54552: sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process's supplementary groups because the privilege-drop sequence does not fully establish the target user's UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4.

Created: 2026-08-22 Last update: 2026-09-04 15:02

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-54552: sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process's supplementary groups because the privilege-drop sequence does not fully establish the target user's UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4.

Created: 2026-08-22 Last update: 2026-09-04 15:02

1 security issue in bullseye high

There is 1 open security issue in bullseye.

1 important issue:

CVE-2026-54552: sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process's supplementary groups because the privilege-drop sequence does not fully establish the target user's UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4.

Created: 2026-08-22 Last update: 2026-08-23 22:00

lintian reports 1 error high

Lintian reports 1 error about this package. You should make the package lintian clean getting rid of them.

Created: 2026-07-04 Last update: 2026-07-04 21:01

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 2.4.0-1, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit c3a4cb808af6309069658048b9d0fc46b3b6609d
Author: Lester Guerzon <lester@guerzon.net>
Date:   Sat Sep 5 16:57:55 2026 +0800

    Debian release for 2.4.0

commit 6e46b9ee40a5c3ae71654814c1205880bb534790
Merge: f08c789 3ea8f57
Author: Lester Guerzon <lester@guerzon.net>
Date:   Sat Sep 5 16:00:21 2026 +0800

    Update upstream source from tag 'upstream/2.4.0'
    
    Update to upstream version '2.4.0'
    with Debian dir 97208c7adc8c8935076a41bbfb5186a42ca37400

commit 3ea8f5797849cf387d2aa3ecf4057480b76464f1
Author: Lester Guerzon <lester@guerzon.net>
Date:   Sat Sep 5 16:00:21 2026 +0800

    New upstream version 2.4.0

https://salsa.debian.org/api/v4/projects/python-team%2Fpackages%2Fpython-sh API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-09-05 Last update: 2026-09-07 13:32

1 low-priority security issue in trixie low

There is 1 open security issue in trixie.

1 issue left for the package maintainer to handle:

CVE-2026-54552: (needs triaging) sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process's supplementary groups because the privilege-drop sequence does not fully establish the target user's UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-08-22 Last update: 2026-09-04 15:02

news

[rss feed]

[2026-07-09] python-sh 2.2.1-2 MIGRATED to testing (Debian testing watch)
[2026-07-04] Accepted python-sh 2.2.1-2 (source) into unstable (Alexandre Detiste)
[2025-02-05] python-sh 2.2.1-1 MIGRATED to testing (Debian testing watch)
[2025-01-30] Accepted python-sh 2.2.1-1 (source) into unstable (Sam Hartman)
[2024-10-20] python-sh 2.0.7-1 MIGRATED to testing (Debian testing watch)
[2024-09-18] Accepted python-sh 2.0.7-1 (source) into unstable (Alexandre Detiste)
[2021-10-15] python-sh 1.14.2-1 MIGRATED to testing (Debian testing watch)
[2021-10-09] Accepted python-sh 1.14.2-1 (source) into unstable (Gordon Ball)
[2021-03-16] Accepted python-sh 1.14.1-1~bpo10+1 (all source) into buster-backports->backports-policy, buster-backports (Debian FTP Masters) (signed by: Andrew Shadura)
[2020-12-17] python-sh 1.14.1-1 MIGRATED to testing (Debian testing watch)
[2020-12-11] Accepted python-sh 1.14.1-1 (source) into unstable (Gordon Ball)
[2019-08-14] python-sh 1.12.14-2 MIGRATED to testing (Debian testing watch)
[2019-08-09] Accepted python-sh 1.12.14-2 (source) into unstable (Ondřej Nový)
[2018-09-20] python-sh 1.12.14-1.1 MIGRATED to testing (Debian testing watch)
[2018-09-14] Accepted python-sh 1.12.14-1.1 (source) into unstable (Antoine Beaupré)
[2015-05-08] python-sh 1.11-1 MIGRATED to testing (Britney)
[2015-05-02] Accepted python-sh 1.11-1 (source all) into unstable (Tianon Gravi) (signed by: Vincent Cheng)
[2014-08-26] python-sh 1.09-1 MIGRATED to testing (Britney)

bugs [bug history graph]

all: 1
RC: 0
I&N: 1
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (1, 0)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.2.1-2