vulnwire
9.8crit

CVE-2017-16764

django_make_app is vulnerable to Code Injection

Also known as GHSA-9pv8-q5rx-c8gq, PYSEC-2017-79

Published 8 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
3.5%
percentile 89%
Public exploits
0
none known

An exploitable vulnerability exists in the YAML parsing functionality in the read_yaml_file method in io_utils.py in django_make_app 0.1.3. A YAML parser can execute arbitrary Python commands resulting in command execution. An attacker can insert Python into loaded YAML to trigger this vulnerability.

Exploit prediction (EPSS)

3.53% probability of exploitation in the next 30 days, higher than 89% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

EcosystemPackageAffectedFixed in
pypidjango-make-app
<=0.1.3
>=0.1.0.1
no fix listed

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

  • github.com /illagrenan/django-make-app/issues/5 · x_refsource_MISC, x_transferred
  • joel-malwarebenchmark.github.io /blog/2017/11/12/cve-2017-16764-vulnerability-in-django-make-app/ · x_refsource_MISC, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2017-16764 · advisory
  • github.com /illagrenan/django-make-app/commit/acd814433d1021aa8783362521b0bd151fdfc9d2 · web
  • github.com /advisories/GHSA-9pv8-q5rx-c8gq · advisory
  • github.com /illagrenan/django-make-app · package
  • github.com /pypa/advisory-database/tree/main/vulns/django-make-app/PYSEC-2017-79.yaml · web
  • joel-malwarebenchmark.github.io /blog/2017/11/12/cve-2017-16764-vulnerability-in-django-make-app · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.