CVE-2017-2810 Loaded Databook of Tablib prone to python insertion resulting in command execution
Attackers can execute arbitrary Python commands by inserting malicious code into YAML files loaded by the Tablib library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-2810?
CVE-2017-2810 is a high-severity code injection vulnerability in Kenneth Reitz Tablib, published on 14 Jun 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4. A yaml loaded Databook can execute arbitrary python commands resulting in command execution. An attacker can insert python into loaded yaml to trigger this vulnerability.
Which versions are affected by CVE-2017-2810?
3 open source packages ship an affected version, including tablib. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tablib PyPI | All versions | 0.11.5 |
tablib PyPI | All versions | 0.11.5 |
tablib PyPI | All versions | 0.11.5 |
Linux distribution packages (3)
python-tablib SUSE:Linux Enterprise Module for Public Cloud 12 | All versions | 0.9.11-3.1 |
python-tablib SUSE:OpenStack Cloud 6 | All versions | 0.9.11-3.1 |
python-tablib SUSE:OpenStack Cloud 7 | All versions | 0.9.11-3.1 |
Products include Python Tablib.
How do I fix CVE-2017-2810?
Upgrade tablib to 0.11.5 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2017-2810 being exploited?
There is no known exploitation of CVE-2017-2810 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2017-2810, GHSA-gcr6-rf47-jrgf, PYSEC-2017-95, SUSE-SU-2017:2105-1, UBUNTU-CVE-2017-2810.