crítica
CVE-2019-17626
python-reportlab: code injection in colors.py allows attacker to execute code
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA. Más baja según Red Hat (alta), Amazon (alta), Oracle (alta), Ubuntu (media).
Descripción
ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| pip::GitHub Security Advisory pip | reportlab | 3.5.28 |
| amazon linux 2 | python-reportlab, python-reportlab-debuginfo, python-reportlab-docs | 2.5-9.amzn2.1 |
| debian 10 | python-reportlab | 3.5.13-1+deb10u1 |
| debian 11 | python-reportlab | 3.5.34-1 |
| debian 12 | python-reportlab | 3.5.34-1 |
| debian 13 | python-reportlab | 3.5.34-1 |
| debian 14 | python-reportlab | 3.5.34-1 |
| debian 8 | python-reportlab | 3.1.8-3+deb8u2 |
| debian 9 | python-reportlab | 3.3.0-2+deb9u1 |
| echo | python-reportlab | 3.5.34-1 |
| Oracle Linux 6 | python-reportlab, python-reportlab-docs | 2.3-3.el6_10.1 |
| Oracle Linux 7 | python-reportlab, python-reportlab-docs | 2.5-9.el7_7.1 |
Mostrar las 22 entradas de 18 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| pip::GitHub Security Advisory pip | reportlab | 3.5.28 |
| amazon linux 2 | python-reportlab | 2.5-9.amzn2.1 |
| amazon linux 2 | python-reportlab-debuginfo | 2.5-9.amzn2.1 |
| amazon linux 2 | python-reportlab-docs | 2.5-9.amzn2.1 |
| debian 10 | python-reportlab | 3.5.13-1+deb10u1 |
| debian 11 | python-reportlab | 3.5.34-1 |
| debian 12 | python-reportlab | 3.5.34-1 |
| debian 13 | python-reportlab | 3.5.34-1 |
| debian 14 | python-reportlab | 3.5.34-1 |
| debian 8 | python-reportlab | 3.1.8-3+deb8u2 |
| debian 9 | python-reportlab | 3.3.0-2+deb9u1 |
| echo | python-reportlab | 3.5.34-1 |
| Oracle Linux 6 | python-reportlab | 2.3-3.el6_10.1 |
| Oracle Linux 6 | python-reportlab-docs | 2.3-3.el6_10.1 |
| Oracle Linux 7 | python-reportlab | 2.5-9.el7_7.1 |
| Oracle Linux 7 | python-reportlab-docs | 2.5-9.el7_7.1 |
| Oracle Linux 8 | python3-reportlab | 3.4.0-6.el8_1.2 |
| ubuntu 16.04 | python-reportlab | 3.3.0-1ubuntu0.1 |
| ubuntu 16.04-ESM | python-reportlab | 3.3.0-1ubuntu0.1 |
| ubuntu 18.04 | python-reportlab | 3.4.0-3ubuntu0.1 |
| ubuntu 18.04-ESM | python-reportlab | 3.4.0-3ubuntu0.1 |
| ubuntu 19.10 | python-reportlab | 3.5.23-1ubuntu0.1 |
Referencias
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00002.html
- https://access.redhat.com/errata/RHSA-2020:0195
- https://access.redhat.com/errata/RHSA-2020:0197
- https://access.redhat.com/errata/RHSA-2020:0201
- https://access.redhat.com/errata/RHSA-2020:0230
- https://access.redhat.com/security/cve/CVE-2019-17626
- https://access.redhat.com/security/cve/cve-2019-17626
- https://bitbucket.org/rptlab/reportlab/issues/199/eval-in-colorspy-leads-to-remote-code
Las 30 referencias
- https://bitbucket.org/rptlab/reportlab/src/default/CHANGES.md
- https://github.com/MrBitBucket/reportlab-mirror
- https://github.com/advisories/GHSA-qpg2-vx7j-3869
- https://github.com/pypa/advisory-database/tree/main/vulns/reportlab/PYSEC-2019-117.yaml
- https://hg.reportlab.com/hg-public/reportlab/rev/51a521ad7dd3
- https://linux.oracle.com/cve/CVE-2019-17626.html
- https://linux.oracle.com/errata/ELSA-2020-0201.html
- https://lists.debian.org/debian-lts-announce/2020/02/msg00019.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NSCTOE3DITFICY2XKBYZ5WAF5TSQ52DM
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NSCTOE3DITFICY2XKBYZ5WAF5TSQ52DM/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZZPHP2BJSTP4IYCSJRQINP763IHO6ASL
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZZPHP2BJSTP4IYCSJRQINP763IHO6ASL/
- https://nvd.nist.gov/vuln/detail/CVE-2019-17626
- https://security.gentoo.org/glsa/202007-35
- https://security.netapp.com/advisory/ntap-20240719-0006
- https://security.netapp.com/advisory/ntap-20240719-0006/
- https://ubuntu.com/security/notices/USN-4273-1
- https://usn.ubuntu.com/4273-1
- https://usn.ubuntu.com/4273-1/
- https://web.archive.org/web/20191016111823/https://bitbucket.org/rptlab/reportlab/issues/199/eval-in-colorspy-leads-to-remote-code
- https://www.cve.org/CVERecord?id=CVE-2019-17626
- https://www.debian.org/security/2020/dsa-4663