Vulnerability Name:

CVE-2017-2810 (CCN-127215)

Assigned:2016-12-01
Published:2017-06-13
Updated:2022-04-19
Summary:An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4. A yaml loaded Databook can execute arbitrary python commands resulting in command execution. An attacker can insert python into loaded yaml to trigger this vulnerability.
CVSS v3 Severity:9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.6 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
6.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.1 High (CCN CVSS v2 Vector: AV:N/AC:H/Au:S/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-noinfo
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2017-2810

Source: BID
Type: Third Party Advisory, VDB Entry
99076

Source: CCN
Type: BID-99076
Tablib CVE-2017-2810 Arbitrary Command Execution Vulnerability

Source: XF
Type: UNKNOWN
tablib-cve20172810-code-exec(127215)

Source: CCN
Type: Python Web site
Tablib

Source: GENTOO
Type: UNKNOWN
GLSA-201811-18

Source: MISC
Type: Exploit, Third Party Advisory, VDB Entry
https://talosintelligence.com/vulnerability_reports/TALOS-2017-0307

Source: CCN
Type: Talos Vulnerability Report TALOS-2017-0307
Tablib Yaml Load Code Execution Vulnerability

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2017-2810

Vulnerable Configuration:Configuration 1:
  • cpe:/a:python:tablib:0.11.4:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:python:tablib:0.11.4:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:55529
    P
    		Security update for podman (Important)
    2023-04-11
    oval:org.opensuse.security:def:20172810
    V
    		CVE-2017-2810
    2022-05-20
    oval:org.opensuse.security:def:55974
    P
    		Security update for webkit2gtk3 (Important)
    2021-11-23
    oval:org.opensuse.security:def:57101
    P
    		Security update for xen (Important)
    2021-09-23
    oval:org.opensuse.security:def:13859
    P
    		kernel-default-4.4.21-69.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:14835
    P
    		atftp-0.7.0-160.8.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:13927
    P
    		libmms0-0.6.2-15.8 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:13974
    P
    		libvorbis-doc-1.3.3-8.23 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:13992
    P
    		openvpn-2.3.8-16.6.4 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:14011
    P
    		ppc64-diag-2.7.1-5.6 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:14104
    P
    		coreutils-8.25-12.8 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:14173
    P
    		jakarta-taglibs-standard-1.1.1-255.2 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:14129
    P
    		emacs-24.3-19.2 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:14184
    P
    		libFLAC++6-1.3.0-11.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:13837
    P
    		gpg2-2.0.24-3.2 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:13829
    P
    		giflib-progs-5.0.5-12.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:14857
    P
    		cpp48-4.8.5-31.20.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:14197
    P
    		libXinerama1-1.1.3-3.54 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:57969
    P
    		Security update for the Linux Kernel (Live Patch 36 for SLE 12 SP3) (Important)
    2021-07-21
    oval:org.opensuse.security:def:57945
    P
    		Security update for apache2 (Important)
    2021-06-17
    oval:org.opensuse.security:def:56995
    P
    		Security update for python3 (Important)
    2021-05-17
    oval:org.opensuse.security:def:57895
    P
    		Security update for xen (Important)
    2021-04-19
    oval:org.opensuse.security:def:57552
    P
    		Security update for screen (Important)
    2021-02-17
    oval:org.opensuse.security:def:55291
    P
    		Security update for wpa_supplicant (Important)
    2021-02-15
    oval:org.opensuse.security:def:39335
    P
    		Security update for perl-Convert-ASN1 (Moderate)
    2021-01-19
    oval:org.opensuse.security:def:38653
    P
    		Security update for MozillaFirefox (Important)
    2021-01-12
    oval:org.opensuse.security:def:55128
    P
    		Security update for python (Important)
    2020-12-11
    oval:org.opensuse.security:def:57826
    P
    		Security update for python-cryptography (Moderate)
    2020-12-04
    oval:org.opensuse.security:def:38625
    P
    		java-1_7_0-openjdk on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:37837
    P
    		lftp on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:38537
    P
    		aaa_base on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:37848
    P
    		libXcursor1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56459
    P
    		Security update for wireshark (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:37836
    P
    		lcms2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56259
    P
    		Security update for open-vm-tools (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:39377
    P
    		Security update for python-tablib (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:38697
    P
    		libmms0 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:37932
    P
    		libopenvswitch-2_8-0 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56533
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55129
    P
    		gpgme on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56367
    P
    		Security update for libdb-4_8 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:57267
    P
    		Security update for vino
    2020-12-01
    oval:org.opensuse.security:def:38069
    P
    		strongswan on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56571
    P
    		Security update for clamav (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55151
    P
    		java-1_7_0-openjdk on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:57752
    P
    		kbd on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:38170
    P
    		dovecot22 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56652
    P
    		Security update for curl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56422
    P
    		Security update for poppler (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:57660
    P
    		accountsservice on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:38228
    P
    		java-1_7_1-ibm on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:57864
    P
    		libupsclient1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56444
    P
    		Security update for libreoffice (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56421
    P
    		Security update for libical (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:38318
    P
    		libldb1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55702
    P
    		Security update for xerces-c (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56584
    P
    		Security update for gd (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:38586
    P
    		elfutils on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:38478
    P
    		sane-backends on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55808
    P
    		Security update for mariadb (Important)
    2020-12-01
    oval:org.opensuse.security:def:56822
    P
    		Security update for ghostscript (Important)
    2020-12-01
    oval:org.opensuse.security:def:80604
    P
    		Security update for python-tablib (Moderate)
    2017-08-08
    oval:com.ubuntu.bionic:def:201728100000000
    V
    		CVE-2017-2810 on Ubuntu 18.04 LTS (bionic) - low.
    2017-06-14
    oval:com.ubuntu.artful:def:20172810000
    V
    		CVE-2017-2810 on Ubuntu 17.10 (artful) - low.
    2017-06-14
    oval:com.ubuntu.xenial:def:20172810000
    V
    		CVE-2017-2810 on Ubuntu 16.04 LTS (xenial) - low.
    2017-06-14
    oval:com.ubuntu.xenial:def:201728100000000
    V
    		CVE-2017-2810 on Ubuntu 16.04 LTS (xenial) - low.
    2017-06-14
    oval:com.ubuntu.bionic:def:20172810000
    V
    		CVE-2017-2810 on Ubuntu 18.04 LTS (bionic) - low.
    2017-06-14
    oval:com.ubuntu.disco:def:201728100000000
    V
    		CVE-2017-2810 on Ubuntu 19.04 (disco) - low.
    2017-06-14
    oval:com.ubuntu.cosmic:def:20172810000
    V
    		CVE-2017-2810 on Ubuntu 18.10 (cosmic) - low.
    2017-06-14
    oval:com.ubuntu.cosmic:def:201728100000000
    V
    		CVE-2017-2810 on Ubuntu 18.10 (cosmic) - low.
    2017-06-14
    oval:com.ubuntu.trusty:def:20172810000
    V
    		CVE-2017-2810 on Ubuntu 14.04 LTS (trusty) - low.
    2017-06-14
    BACK
    python tablib 0.11.4
    python tablib 0.11.4