conference-scheduler-cli Arbitrary Code Execution

2018-10-2919:05:38

Google

osv.dev

0.003 Low

EPSS

Percentile

67.9%

JSON

In conference-scheduler-cli, a pickle.load call on imported data allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call.

CPENameOperatorVersion
conference-scheduler-clieq0.3.0
conference-scheduler-clieq0.7.1
conference-scheduler-clieq0.7.2
conference-scheduler-clieq0.8.1
conference-scheduler-clieq0.5.0
conference-scheduler-clieq0.4.1
conference-scheduler-clieq0.8.2
conference-scheduler-clieq0.9.0
conference-scheduler-clieq0.8.3
conference-scheduler-clieq0.9.1

Name	Operator	Version
conference-scheduler-cli	eq	0.3.0
conference-scheduler-cli	eq	0.7.1
conference-scheduler-cli	eq	0.7.2
conference-scheduler-cli	eq	0.8.1
conference-scheduler-cli	eq	0.5.0
conference-scheduler-cli	eq	0.4.1
conference-scheduler-cli	eq	0.8.2
conference-scheduler-cli	eq	0.9.0
conference-scheduler-cli	eq	0.8.3
conference-scheduler-cli	eq	0.9.1