Created originally on Bitbucket by Hervé Beraud (hervé beraud)
Was already merged in Bitbucket before import, marked as merged by the import user
Convert shutil._call_external_zip to use subprocess rather than distutlils.spawn
Subject
When shutil.make_archive falls back to te external zip problem, it use subprocess to invoke it rather than distutils.spawn.
This closes a possible shell injection vector. distutils.spawn isn't very good at quoting command lines.
CVE: https://nvd.nist.gov/vuln/detail/CVE-2018-1000802
Resolve: https://bugs.python.org/issue34540
Original pull-request on CPython: https://github.com/python/cpython/pull/8985
Original-Author: Benjamin Peterson benjamin@python.org