PYSEC-2017-79

2017-11-1009:29:00

Google

osv.dev

0.017 Low

EPSS

Percentile

87.8%

JSON

An exploitable vulnerability exists in the YAML parsing functionality in the read_yaml_file method in io_utils.py in django_make_app 0.1.3. A YAML parser can execute arbitrary Python commands resulting in command execution. An attacker can insert Python into loaded YAML to trigger this vulnerability.

CPENameOperatorVersion
django-make-appeq0.1.2.1
django-make-appeq0.1.0.1
django-make-appeq0.1.2
django-make-appeq0.1.1
django-make-appeq0.1.3

Name	Operator	Version
django-make-app	eq	0.1.2.1
django-make-app	eq	0.1.0.1
django-make-app	eq	0.1.2
django-make-app	eq	0.1.1
django-make-app	eq	0.1.3

References

github.com/advisories/GHSA-9pv8-q5rx-c8gq

github.com/illagrenan/django-make-app/issues/5

joel-malwarebenchmark.github.io/blog/2017/11/12/cve-2017-16764-vulnerability-in-django-make-app/

0.017 Low

EPSS

Percentile

87.8%

JSON

Related for OSV:PYSEC-2017-79