CVE-2017-16618

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2017-16618

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-16618.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2017-16618

Aliases

Published

2017-11-08T03:29:00.277Z

Modified

2026-07-08T05:51:30.008413031Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

An exploitable vulnerability exists in the YAML loading functionality of util.py in OwlMixin before 2.0.0a12. A "Load YAML" string or file (aka loadyaml or loadyamlf) can execute arbitrary Python commands resulting in command execution because load is used where safe_load should have been used. An attacker can insert Python into loaded YAML to trigger this vulnerability.

Database specific

{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:owlmixin_project:owlmixin:2.0.0:alpha10:*:*:*:*:*:*",
                "cpe:2.3:a:owlmixin_project:owlmixin:2.0.0:alpha11:*:*:*:*:*:*",
                "cpe:2.3:a:owlmixin_project:owlmixin:2.0.0:alpha1:*:*:*:*:*:*",
                "cpe:2.3:a:owlmixin_project:owlmixin:2.0.0:alpha2:*:*:*:*:*:*",
                "cpe:2.3:a:owlmixin_project:owlmixin:2.0.0:alpha3:*:*:*:*:*:*",
                "cpe:2.3:a:owlmixin_project:owlmixin:2.0.0:alpha4:*:*:*:*:*:*",
                "cpe:2.3:a:owlmixin_project:owlmixin:2.0.0:alpha5:*:*:*:*:*:*",
                "cpe:2.3:a:owlmixin_project:owlmixin:2.0.0:alpha6:*:*:*:*:*:*",
                "cpe:2.3:a:owlmixin_project:owlmixin:2.0.0:alpha7:*:*:*:*:*:*",
                "cpe:2.3:a:owlmixin_project:owlmixin:2.0.0:alpha8:*:*:*:*:*:*",
                "cpe:2.3:a:owlmixin_project:owlmixin:2.0.0:alpha9:*:*:*:*:*:*"
            ],
            "vendor_product": "owlmixin_project:owlmixin",
            "extracted_events": [
                {
                    "introduced": "2.0.0-alpha1"
                },
                {
                    "last_affected": "2.0.0-alpha1"
                },
                {
                    "introduced": "2.0.0-alpha10"
                },
                {
                    "last_affected": "2.0.0-alpha10"
                },
                {
                    "introduced": "2.0.0-alpha11"
                },
                {
                    "last_affected": "2.0.0-alpha11"
                },
                {
                    "introduced": "2.0.0-alpha2"
                },
                {
                    "last_affected": "2.0.0-alpha2"
                },
                {
                    "introduced": "2.0.0-alpha3"
                },
                {
                    "last_affected": "2.0.0-alpha3"
                },
                {
                    "introduced": "2.0.0-alpha4"
                },
                {
                    "last_affected": "2.0.0-alpha4"
                },
                {
                    "introduced": "2.0.0-alpha5"
                },
                {
                    "last_affected": "2.0.0-alpha5"
                },
                {
                    "introduced": "2.0.0-alpha6"
                },
                {
                    "last_affected": "2.0.0-alpha6"
                },
                {
                    "introduced": "2.0.0-alpha7"
                },
                {
                    "last_affected": "2.0.0-alpha7"
                },
                {
                    "introduced": "2.0.0-alpha8"
                },
                {
                    "last_affected": "2.0.0-alpha8"
                },
                {
                    "introduced": "2.0.0-alpha9"
                },
                {
                    "last_affected": "2.0.0-alpha9"
                }
            ],
            "source": "CPE_STRING"
        }
    ]
}

References

Affected packages

Git / github.com/tadashi-aikawa/owlmixin

Affected ranges

Type

GIT

Repo

https://github.com/tadashi-aikawa/owlmixin

Events

Introduced

Fixed

de81bf86fd4584f49cdd4eb67012e85d2aaed771

Fixed

5d0575303f6df869a515ced4285f24ba721e0d4e

Database specific

{
    "cpe": "cpe:2.3:a:owlmixin_project:owlmixin:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.0.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.2.0

0.2.1

0.3.0

0.3.1

0.4.0

0.5.0

0.5.1

0.6.0

0.7.0

0.7.1

0.8.0

1.*

1.0.0

1.0.0a1

1.0.0a2

1.0.0b1

1.0.0b2

1.0.0b3

1.0.0b4

1.0.0b5

1.0.0b6

1.0.0b7

1.0.0rc1

1.0.0rc10

1.0.0rc11

1.0.0rc12

1.0.0rc13

1.0.0rc14

1.0.0rc15

1.0.0rc16

1.0.0rc2

1.0.0rc3

1.0.0rc4

1.0.0rc5

1.0.0rc6

1.0.0rc7

1.0.0rc8

1.0.0rc9

1.1.0

1.2.0

2.*

2.0.0a10

2.0.0a11

2.0.0a12

2.0.0a2

2.0.0a3

2.0.0a4

2.0.0a5

2.0.0a6

2.0.0a7

2.0.0a8

2.0.0a9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-16618.json"