CVE-2017-2810

EUVD-2017-0134
An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4. A yaml loaded Databook can execute arbitrary python commands resulting in command execution. An attacker can insert python into loaded yaml to trigger this vulnerability.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
HIGH
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
talosCNA
7.5 HIGH
NETWORK
HIGH
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 84%
Affected Products (NVD)
VendorProductVersion
pythontablib
0.11.4
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
python-tablib
bookworm
3.4.0-1
fixed
bullseye
0.13.0-1
fixed
sid
3.7.0-1
fixed
trixie
3.7.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
python-tablib
artful
ignored
bionic
not-affected
cosmic
not-affected
disco
not-affected
trusty
dne
xenial
Fixed 0.9.11-2+deb9u1build0.16.04.1
released
yakkety
ignored
zesty
ignored
References
http://www.securityfocus.com/bid/99076
https://security.gentoo.org/glsa/201811-18
https://talosintelligence.com/vulnerability_reports/TALOS-2017-0307
http://www.securityfocus.com/bid/99076
https://security.gentoo.org/glsa/201811-18
https://talosintelligence.com/vulnerability_reports/TALOS-2017-0307