Created calibre tracking bugs for this issue:
Affects: fedora-all [bug 1417557]
A fix for this CVE was merged in Calibre on 21/12/2016 and became part of version 3.1.1.
If the fix was merged in Calibre 3.1.1, then we can probably close this ticket, right? 3.1.1 was a while ago.