CVE-2017-2810

An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4. A yaml loaded Databook can execute arbitrary python commands resulting in command execution. An attacker can insert python into loaded yaml to trigger this vulnerability.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
HIGH
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
talosCNA
7.5 HIGH
NETWORK
HIGH
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 88%
VendorProductVersion
pythontablib
0.11.4
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
python-tablib
bullseye
0.13.0-1
fixed
bookworm
3.4.0-1
fixed
sid
3.7.0-1
fixed
trixie
3.7.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
python-tablib
disco
not-affected
cosmic
not-affected
bionic
not-affected
artful
ignored
zesty
ignored
yakkety
ignored
xenial
Fixed 0.9.11-2+deb9u1build0.16.04.1
released
trusty
dne