id: PYSEC-2018-64
details: In conference-scheduler-cli, a pickle.load call on imported data allows remote
  attackers to execute arbitrary code via a crafted .pickle file, as demonstrated
  by Python code that contains an os.system call.
affected:
- package:
    name: conference-scheduler-cli
    ecosystem: PyPI
    purl: pkg:pypi/conference-scheduler-cli
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: '0'
  versions:
  - 0.1.0
  - 0.10.1
  - 0.2.0
  - 0.3.0
  - 0.3.1
  - 0.4.0
  - 0.4.1
  - 0.5.0
  - 0.6.0
  - 0.7.0
  - 0.7.1
  - 0.7.2
  - 0.8.0
  - 0.8.1
  - 0.8.2
  - 0.8.3
  - 0.8.4
  - 0.9.0
  - 0.9.1
references:
- type: REPORT
  url: https://github.com/PyconUK/ConferenceScheduler-cli/issues/19
- type: ARTICLE
  url: https://joel-malwarebenchmark.github.io/blog/2020/04/25/cve-2018-14572-conference-scheduler-cli/
- type: ADVISORY
  url: https://github.com/advisories/GHSA-cf3c-fffp-34qh
aliases:
- CVE-2018-14572
- GHSA-cf3c-fffp-34qh
modified: '2021-08-25T04:29:57.468517Z'
published: '2018-08-28T19:29:00Z'