id: PYSEC-2018-95
details: An issue was discovered in Yelp OSXCollector. A maliciously crafted Universal/fat
  binary can evade third-party code signing checks. By not completing full inspection
  of the Universal/fat binary, the user of the third-party tool will believe that
  the code is signed by Apple, but the malicious unsigned code will execute.
affected:
- package:
    name: osxcollector
    ecosystem: PyPI
    purl: pkg:pypi/osxcollector
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: "1.10"
  versions:
  - "1.7"
  - "1.8"
references:
- type: ARTICLE
  url: 
    https://www.okta.com/security-blog/2018/06/issues-around-third-party-apple-code-signing-checks/
- type: ADVISORY
  url: https://github.com/advisories/GHSA-g3cc-pvjj-9xq9
aliases:
- CVE-2018-10406
- GHSA-g3cc-pvjj-9xq9
modified: "2021-08-27T03:22:09.893229Z"
published: "2018-06-13T22:29:00Z"