PYSEC-2020-341

2020-05-2217:15:00

Google

osv.dev

0.043 Low

EPSS

Percentile

92.3%

JSON

An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safe_load is not used.

CPENameOperatorVersion
jw-utileq-class.-jw.util.version.Version-
jw-utileq1.9.1
jw-utileq1.0a
jw-utileq1.5a4
jw-utileq1.0dev1
jw-utileq1.9.2
jw-utileq1.5b0
jw-utileq1.5.2
jw-utileq1.8
jw-utileq1.3.6

Name	Operator	Version
jw-util	eq	-class.-jw.util.version.Version-
jw-util	eq	1.9.1
jw-util	eq	1.0a
jw-util	eq	1.5a4
jw-util	eq	1.0dev1
jw-util	eq	1.9.2
jw-util	eq	1.5b0
jw-util	eq	1.5.2
jw-util	eq	1.8
jw-util	eq	1.3.6