CVE-2018-14572

2018-08-2819:29:16

Google

osv.dev

0.003 Low

EPSS

Percentile

67.9%

JSON

In conference-scheduler-cli, a pickle.load call on imported data allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call.

CPENameOperatorVersion
conferencescheduler-clieq0.8.3
conferencescheduler-clieq0.9.1
conferencescheduler-clieq0.4.1
conferencescheduler-clieq0.2.0
conferencescheduler-clieq0.7.0
conferencescheduler-clieq0.6.0
conferencescheduler-clieq0.10.1
conferencescheduler-clieq0.8.0
conferencescheduler-clieq0.8.4
conferencescheduler-clieq0.1.0

Name	Operator	Version
conferencescheduler-cli	eq	0.8.3
conferencescheduler-cli	eq	0.9.1
conferencescheduler-cli	eq	0.4.1
conferencescheduler-cli	eq	0.2.0
conferencescheduler-cli	eq	0.7.0
conferencescheduler-cli	eq	0.6.0
conferencescheduler-cli	eq	0.10.1
conferencescheduler-cli	eq	0.8.0
conferencescheduler-cli	eq	0.8.4
conferencescheduler-cli	eq	0.1.0