Candidate: CVE-2017-2810
PublicDate: 2017-06-14 13:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2810
 https://talosintelligence.com/vulnerability_reports/TALOS-2017-0307
Description:
 An exploitable vulnerability exists in the Databook loading functionality
 of Tablib 0.11.4. A yaml loaded Databook can execute arbitrary python
 commands resulting in command execution. An attacker can insert python into
 loaded yaml to trigger this vulnerability.
Ubuntu-Description:
Notes:
 msalvatore> Fix can be found in 0.9.11-2+deb9u1
Bugs:
Priority: low
Discovered-by: Cory Duplantis
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [9.8 CRITICAL]

Patches_python-tablib:
 upstream: https://github.com/kennethreitz/tablib/commit/69abfc3ada5d754cb152119c0b4777043657cb6e
upstream_python-tablib: released (0.9.11-2+deb8u1, 0.9.11-3)
precise/esm_python-tablib: DNE
trusty_python-tablib: ignored (reached end-of-life)
trusty/esm_python-tablib: DNE (trusty was needed)
vivid/stable-phone-overlay_python-tablib: DNE
vivid/ubuntu-core_python-tablib: DNE
xenial_python-tablib: released (0.9.11-2+deb9u1build0.16.04.1)
yakkety_python-tablib: ignored (reached end-of-life)
zesty_python-tablib: ignored (reached end-of-life)
artful_python-tablib: ignored (reached end-of-life)
bionic_python-tablib: not-affected (0.9.11-3)
cosmic_python-tablib: not-affected (0.9.11-3)
disco_python-tablib: not-affected (0.9.11-3)
devel_python-tablib: not-affected (0.9.11-3)