CVE:CVE-2017-16618
CNNVD:CNNVD-201711-221
OwlMixin是一款基于Python的能够将数据类实例、dict对象、json字符串和yaml字符串进行相互转换的工具。
OwlMixin 2.0.0a12之前的版本中的util.py文件的YAML加载功能存在安全漏洞。攻击者可通过向已加载的YAML注入Python利用该漏洞执行任意的Python命令。
solution:Upgrade owlmixin_project owlmixin to a higher version than 2.0.0,2.0.0:alpha1,2.0.0:alpha10,2.0.0:alpha11,2.0.0:alpha2,2.0.0:alpha3,2.0.0:alpha4,2.0.0:alpha5,2.0.0:alpha6,2.0.0:alpha7,2.0.0:alpha8,2.0.0:alpha9,and avoid the version (,2.0.0),2.0.0:alpha1,2.0.0:alpha10,2.0.0:alpha11,2.0.0:alpha2,2.0.0:alpha3,2.0.0:alpha4,2.0.0:alpha5,2.0.0:alpha6,2.0.0:alpha7,2.0.0:alpha8,2.0.0:alpha9