id: PYSEC-2017-78
details: An exploitable vulnerability exists in the YAML parsing functionality in
  config.py in Confire 0.2.0. Due to the user-specific configuration being loaded
  from "~/.confire.yaml" using the yaml.load function, a YAML parser can execute arbitrary
  Python commands resulting in command execution. An attacker can insert Python into
  loaded YAML to trigger this vulnerability.
affected:
- package:
    name: confire
    ecosystem: PyPI
    purl: pkg:pypi/confire
  ranges:
  - type: GIT
    repo: https://github.com/bbengfort/confire
    events:
    - introduced: '0'
    - fixed: 8cc86a5ec2327e070f1d576d61bbaadf861597ea
  - type: ECOSYSTEM
    events:
    - introduced: 0.1.0
  versions:
  - 0.1.0
  - 0.1.1
  - 0.2.0
references:
- type: REPORT
  url: https://github.com/bbengfort/confire/issues/24
- type: ARTICLE
  url: https://joel-malwarebenchmark.github.io/blog/2017/11/12/cve-2017-16763-configure-loaded-through-confire/
- type: FIX
  url: https://github.com/bbengfort/confire/commit/8cc86a5ec2327e070f1d576d61bbaadf861597ea
- type: ADVISORY
  url: https://github.com/advisories/GHSA-m85c-9mf8-m2m6
aliases:
- CVE-2017-16763
- GHSA-m85c-9mf8-m2m6
modified: '2021-08-25T04:29:57.582065Z'
published: '2017-11-10T09:29:00Z'