An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4. A yaml loaded Databook can execute arbitrary python commands resulting in command execution. An attacker can insert python into loaded yaml to trigger this vulnerability.
Scores
Version
Score
Vecteur
Évalué par
CVSS 3.0
HIGH 7.5
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
talos
CVSS 3.0
HIGH 7.5
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD · talos-cna@cisco.com (Secondary)
CVSS 3.0
CRITICAL 9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD · nvd@nist.gov (Primary)
CVSS 2.0
HIGH 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
NVD · nvd@nist.gov (Primary)
Avis
GHSA-gcr6-rf47-jrgf — Loaded Databook of Tablib prone to python insertion resulting in command execution
PYSEC-2017-95 — An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4. A yaml loaded Databook can execute arbitrary python commands resulti
