{"id":"PYSEC-2018-64","details":"In conference-scheduler-cli, a pickle.load call on imported data allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call.","aliases":["CVE-2018-14572","GHSA-cf3c-fffp-34qh"],"modified":"2023-11-08T03:59:55.708553Z","published":"2018-08-28T19:29:00Z","references":[{"type":"REPORT","url":"https://github.com/PyconUK/ConferenceScheduler-cli/issues/19"},{"type":"ARTICLE","url":"https://joel-malwarebenchmark.github.io/blog/2020/04/25/cve-2018-14572-conference-scheduler-cli/"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-cf3c-fffp-34qh"}],"affected":[{"package":{"name":"conference-scheduler-cli","ecosystem":"PyPI","purl":"pkg:pypi/conference-scheduler-cli"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.0","0.10.1","0.2.0","0.3.0","0.3.1","0.4.0","0.4.1","0.5.0","0.6.0","0.7.0","0.7.1","0.7.2","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.9.0","0.9.1"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/conference-scheduler-cli/PYSEC-2018-64.yaml"}}],"schema_version":"1.7.3"}