CVE-2017-2810 Loaded Databook of Tablib prone to python insertion resulting in command execution
CriticalCVSS 9.8
EPSS 4.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4. A yaml loaded Databook can execute arbitrary python commands resulting in command execution. An attacker can insert python into loaded yaml to trigger this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi tablib(PyPI) | < 0.11.5 | 0.11.5 |
| pypi tablib(PyPI) | = 0.0.1 | No fix listed |
| pypi tablib(PyPI) | = 0.10.0 | No fix listed |
| pypi tablib(PyPI) | = 0.11.0 | No fix listed |
| pypi tablib(PyPI) | = 0.11.1 | No fix listed |
| pypi tablib(PyPI) | = 0.11.2 | No fix listed |
| pypi tablib(PyPI) | = 0.11.3 | No fix listed |
| pypi tablib(PyPI) | = 0.11.4 | No fix listed |
| pypi tablib(PyPI) | = 0.6.1 | No fix listed |
| pypi tablib(PyPI) | = 0.6.2 | No fix listed |
| pypi tablib(PyPI) | = 0.6.3 | No fix listed |
| pypi tablib(PyPI) | = 0.6.4 | No fix listed |
| pypi tablib(PyPI) | = 0.7.0 | No fix listed |
| pypi tablib(PyPI) | = 0.7.1 | No fix listed |
| pypi tablib(PyPI) | = 0.8.0 | No fix listed |
| pypi tablib(PyPI) | = 0.8.1 | No fix listed |
| pypi tablib(PyPI) | = 0.8.2 | No fix listed |
| pypi tablib(PyPI) | = 0.8.3 | No fix listed |
| pypi tablib(PyPI) | = 0.8.4 | No fix listed |
| pypi tablib(PyPI) | = 0.9.0 | No fix listed |
| pypi tablib(PyPI) | = 0.9.1 | No fix listed |
| pypi tablib(PyPI) | = 0.9.10 | No fix listed |
| pypi tablib(PyPI) | = 0.9.11 | No fix listed |
| pypi tablib(PyPI) | = 0.9.2 | No fix listed |
| pypi tablib(PyPI) | = 0.9.3 | No fix listed |
Show 11 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi tablib(PyPI) | = 0.9.4 | No fix listed |
| pypi tablib(PyPI) | = 0.9.5 | No fix listed |
| pypi tablib(PyPI) | = 0.9.6 | No fix listed |
| pypi tablib(PyPI) | = 0.9.7 | No fix listed |
| pypi tablib(PyPI) | = 0.9.8 | No fix listed |
| pypi tablib(PyPI) | = 0.9.9 | No fix listed |
| debian/python-tablib(Debian:12) | < 0.9.11-3 | 0.9.11-3 |
| debian/python-tablib(Debian:13) | < 0.9.11-3 | 0.9.11-3 |
| debian/python-tablib(Debian:14) | < 0.9.11-3 | 0.9.11-3 |
| python tablib | = 0.11.4 | No fix listed |
| Kenneth Reitz Tablib | = 0.11.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com vendor-advisory
- github.com product
- github.com
- GLSA-201811-18 vendor-advisory
- talosintelligence.com exploit third-party-advisory vdb-entry
- 99076 third-party-advisory vdb-entry
- Debian Security Tracker CVE-2017-2810 vendor-advisory
- bugs.debian.org issue-tracking