id: PYSEC-2017-79
details: An exploitable vulnerability exists in the YAML parsing functionality in
  the read_yaml_file method in io_utils.py in django_make_app 0.1.3. A YAML parser
  can execute arbitrary Python commands resulting in command execution. An attacker
  can insert Python into loaded YAML to trigger this vulnerability.
affected:
- package:
    name: django-make-app
    ecosystem: PyPI
    purl: pkg:pypi/django-make-app
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: 0.1.0.1
  versions:
  - 0.1.0.1
  - 0.1.1
  - 0.1.2
  - 0.1.2.1
  - 0.1.3
references:
- type: REPORT
  url: https://github.com/illagrenan/django-make-app/issues/5
- type: ARTICLE
  url: https://joel-malwarebenchmark.github.io/blog/2017/11/12/cve-2017-16764-vulnerability-in-django-make-app/
- type: ADVISORY
  url: https://github.com/advisories/GHSA-9pv8-q5rx-c8gq
aliases:
- CVE-2017-16764
- GHSA-9pv8-q5rx-c8gq
modified: "2021-08-25T04:29:58.287263Z"
published: "2017-11-10T09:29:00Z"