critique
CVE-2019-17626
python-reportlab: code injection in colors.py allows attacker to execute code
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, GHSA. Plus basse selon Red Hat (élevée), Amazon (élevée), Oracle (élevée), Ubuntu (moyenne).
Description
ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| pip::GitHub Security Advisory pip | reportlab | 3.5.28 |
| amazon linux 2 | python-reportlab, python-reportlab-debuginfo, python-reportlab-docs | 2.5-9.amzn2.1 |
| debian 10 | python-reportlab | 3.5.13-1+deb10u1 |
| debian 11 | python-reportlab | 3.5.34-1 |
| debian 12 | python-reportlab | 3.5.34-1 |
| debian 13 | python-reportlab | 3.5.34-1 |
| debian 14 | python-reportlab | 3.5.34-1 |
| debian 8 | python-reportlab | 3.1.8-3+deb8u2 |
| debian 9 | python-reportlab | 3.3.0-2+deb9u1 |
| echo | python-reportlab | 3.5.34-1 |
| Oracle Linux 6 | python-reportlab, python-reportlab-docs | 2.3-3.el6_10.1 |
| Oracle Linux 7 | python-reportlab, python-reportlab-docs | 2.5-9.el7_7.1 |
Afficher les 22 entrées de 18 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| pip::GitHub Security Advisory pip | reportlab | 3.5.28 |
| amazon linux 2 | python-reportlab | 2.5-9.amzn2.1 |
| amazon linux 2 | python-reportlab-debuginfo | 2.5-9.amzn2.1 |
| amazon linux 2 | python-reportlab-docs | 2.5-9.amzn2.1 |
| debian 10 | python-reportlab | 3.5.13-1+deb10u1 |
| debian 11 | python-reportlab | 3.5.34-1 |
| debian 12 | python-reportlab | 3.5.34-1 |
| debian 13 | python-reportlab | 3.5.34-1 |
| debian 14 | python-reportlab | 3.5.34-1 |
| debian 8 | python-reportlab | 3.1.8-3+deb8u2 |
| debian 9 | python-reportlab | 3.3.0-2+deb9u1 |
| echo | python-reportlab | 3.5.34-1 |
| Oracle Linux 6 | python-reportlab | 2.3-3.el6_10.1 |
| Oracle Linux 6 | python-reportlab-docs | 2.3-3.el6_10.1 |
| Oracle Linux 7 | python-reportlab | 2.5-9.el7_7.1 |
| Oracle Linux 7 | python-reportlab-docs | 2.5-9.el7_7.1 |
| Oracle Linux 8 | python3-reportlab | 3.4.0-6.el8_1.2 |
| ubuntu 16.04 | python-reportlab | 3.3.0-1ubuntu0.1 |
| ubuntu 16.04-ESM | python-reportlab | 3.3.0-1ubuntu0.1 |
| ubuntu 18.04 | python-reportlab | 3.4.0-3ubuntu0.1 |
| ubuntu 18.04-ESM | python-reportlab | 3.4.0-3ubuntu0.1 |
| ubuntu 19.10 | python-reportlab | 3.5.23-1ubuntu0.1 |
Références
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00002.html
- https://access.redhat.com/errata/RHSA-2020:0195
- https://access.redhat.com/errata/RHSA-2020:0197
- https://access.redhat.com/errata/RHSA-2020:0201
- https://access.redhat.com/errata/RHSA-2020:0230
- https://access.redhat.com/security/cve/CVE-2019-17626
- https://access.redhat.com/security/cve/cve-2019-17626
- https://bitbucket.org/rptlab/reportlab/issues/199/eval-in-colorspy-leads-to-remote-code
Les 30 références
- https://bitbucket.org/rptlab/reportlab/src/default/CHANGES.md
- https://github.com/MrBitBucket/reportlab-mirror
- https://github.com/advisories/GHSA-qpg2-vx7j-3869
- https://github.com/pypa/advisory-database/tree/main/vulns/reportlab/PYSEC-2019-117.yaml
- https://hg.reportlab.com/hg-public/reportlab/rev/51a521ad7dd3
- https://linux.oracle.com/cve/CVE-2019-17626.html
- https://linux.oracle.com/errata/ELSA-2020-0201.html
- https://lists.debian.org/debian-lts-announce/2020/02/msg00019.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NSCTOE3DITFICY2XKBYZ5WAF5TSQ52DM
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NSCTOE3DITFICY2XKBYZ5WAF5TSQ52DM/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZZPHP2BJSTP4IYCSJRQINP763IHO6ASL
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZZPHP2BJSTP4IYCSJRQINP763IHO6ASL/
- https://nvd.nist.gov/vuln/detail/CVE-2019-17626
- https://security.gentoo.org/glsa/202007-35
- https://security.netapp.com/advisory/ntap-20240719-0006
- https://security.netapp.com/advisory/ntap-20240719-0006/
- https://ubuntu.com/security/notices/USN-4273-1
- https://usn.ubuntu.com/4273-1
- https://usn.ubuntu.com/4273-1/
- https://web.archive.org/web/20191016111823/https://bitbucket.org/rptlab/reportlab/issues/199/eval-in-colorspy-leads-to-remote-code
- https://www.cve.org/CVERecord?id=CVE-2019-17626
- https://www.debian.org/security/2020/dsa-4663