GHSA-cf3c-fffp-34qh

conference-scheduler-cli Arbitrary Code Execution

Source: GitHub Advisory Database (reviewed) High CVE-2018-14572

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	conference-scheduler-cli	<= 0.10.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

In conference-scheduler-cli, a pickle.load call on imported data allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-14572 advisory
https://github.com/PyconUK/ConferenceScheduler-cli/issues/19 web
https://github.com/PyconUK/ConferenceScheduler-cli package
https://github.com/advisories/GHSA-cf3c-fffp-34qh advisory
https://github.com/pypa/advisory-database/tree/main/vulns/conference-scheduler-cli/PYSEC-2018-64.yaml web
https://joel-malwarebenchmark.github.io/blog/2020/04/25/cve-2018-14572-conference-scheduler-cli web