An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4. A yaml loaded Databook can execute arbitrary python commands resulting in command execution. An attacker can insert python into loaded yaml to trigger this vulnerability.

The remote host is affected by the vulnerability described in GLSA-201811-18 (Tablib: Arbitrary command execution)

    A vulnerability was discovered in Tablib&rsquo;s Databook loading       functionality, due to improper input validation.
  Impact :

    A remote attacker, by enticing the user to process a specially crafted       Databook via YAML, could possibly execute arbitrary python commands with       the privilege of the process.
  Workaround :

    There is no known workaround at this time.

Latest upstream, including the `yaml.safe_load` fix for CVE-2017-2810.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python-tablib fixes the following issues :

  - CVE-2017-2810: The Databook loading functionality     allowed command execution when important malicious data     (boo#1044329)

ID	Name	Product	Family	Severity
119163	GLSA-201811-18 : Tablib: Arbitrary command execution	Nessus	Gentoo Local Security Checks	critical
102723	Fedora 25 : python-tablib (2017-fe04b06b64)	Nessus	Fedora Local Security Checks	critical
102632	Fedora 26 : python-tablib (2017-dd0d5d376f)	Nessus	Fedora Local Security Checks	critical
101133	openSUSE Security Update : python-tablib (openSUSE-2017-733)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2017-2810

critical

Tenable Plugins

critical

critical

critical

critical