CVE-2017-16618

Description

An exploitable vulnerability exists in the YAML loading functionality of util.py in OwlMixin before 2.0.0a12. A "Load YAML" string or file (aka load_yaml or load_yamlf) can execute arbitrary Python commands resulting in command execution because load is used where safe_load should have been used. An attacker can insert Python into loaded YAML to trigger this vulnerability.

How to fix CVE-2017-16618

To remediate CVE-2017-16618, upgrade the affected package to a fixed version below.

• —upgrade to 2.0.0 or later
• —upgrade to 5d0575303f6df869a515ced4285f24ba721e0d4e or later

Is CVE-2017-16618 being exploited?

Low — EPSS is 2.0%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 2.0.0
• from 0, < 5d0575303f6df869a515ced4285f24ba721e0d4e | from 0, < 2.0.0

CVSS scores

References (8)

• ADVISORYgithub.com/advisories/GHSA-ccmq-qvcp-5mrm
• ADVISORYjoel-malwarebenchmark.github.io/blog/2017/11/08/cve-2017-16618-convert-through-owlmixin/
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2017-16618
• PATCHgithub.com/tadashi-aikawa/owlmixin