PT-2017-2870 · Python+1 · Tablib+1
Publicado
2017-04-18
·
Atualizado
2022-04-19
·
CVE-2017-2810
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Tablib version 0.11.4
Description
The issue is related to the Databook loading functionality in Tablib, where a yaml loaded Databook can execute arbitrary python commands, resulting in command execution. This is due to the lack of input data sanitization in the
yaml.load function. An attacker can insert python code into loaded yaml to trigger this vulnerability, potentially allowing a remote attacker to execute arbitrary commands.Recommendations
For Tablib version 0.11.4, consider disabling the Databook loading functionality or restricting the use of
yaml.load until a patch is available. As a temporary workaround, avoid using the yaml.load function to load untrusted yaml files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Command Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Suse
Tablib