CVE-2017-16763

Critical

Published: 10/11/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

An exploitable vulnerability exists in the YAML parsing functionality in config.py in Confire 0.2.0. Due to the user-specific configuration being loaded from '~/.confire.yaml' using the yaml.load function, an attacker can inject Python commands, leading to arbitrary command execution.

Risk Assessment

This vulnerability poses a serious security risk, allowing attackers to execute arbitrary code on the server, potentially leading to data loss or system takeover.

Recommendation

It is recommended to avoid using yaml.load with untrusted data and to upgrade to a newer version of Confire that addresses this vulnerability.

Original NVD description (English source)

An exploitable vulnerability exists in the YAML parsing functionality in config.py in Confire 0.2.0. Due to the user-specific configuration being loaded from "~/.confire.yaml" using the yaml.load function, a YAML parser can execute arbitrary Python commands resulting in command execution. An attacker can insert Python into loaded YAML to trigger this vulnerability.