critique
CVE-2019-19450
python-reportlab: code injection in paraparser.py allows code execution
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, GHSA. Plus basse selon Red Hat (élevée), AlmaLinux (élevée), Amazon (élevée), Oracle (élevée).
Description
paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| pip::GitHub Security Advisory pip | reportlab | 3.5.31 |
| alma 8 | python3-reportlab | 3.4.0-8.el8_8.1.alma.1 |
| amazon linux 2 | python-reportlab, python-reportlab-debuginfo, python-reportlab-docs | 2.5-10.amzn2.0.1 |
| debian 10 | python-reportlab | 3.5.13-1+deb10u2 |
| debian 11 | python-reportlab | 3.5.31-1 |
| debian 12 | python-reportlab | 3.5.31-1 |
| debian 13 | python-reportlab | 3.5.31-1 |
| debian 14 | python-reportlab | 3.5.31-1 |
| echo | python-reportlab | 3.5.31-1 |
| Oracle Linux 7 | python-reportlab, python-reportlab-docs | 2.5-11.el7_9 |
| Oracle Linux 8 | python3-reportlab | 3.4.0-8.el8_8.1 |
| Red Hat | python-reportlab, python-reportlab-docs | pas de correctif indiqué |
Afficher les 16 entrées de 12 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| pip::GitHub Security Advisory pip | reportlab | 3.5.31 |
| alma 8 | python3-reportlab | 3.4.0-8.el8_8.1.alma.1 |
| amazon linux 2 | python-reportlab | 2.5-10.amzn2.0.1 |
| amazon linux 2 | python-reportlab-debuginfo | 2.5-10.amzn2.0.1 |
| amazon linux 2 | python-reportlab-docs | 2.5-10.amzn2.0.1 |
| debian 10 | python-reportlab | 3.5.13-1+deb10u2 |
| debian 11 | python-reportlab | 3.5.31-1 |
| debian 12 | python-reportlab | 3.5.31-1 |
| debian 13 | python-reportlab | 3.5.31-1 |
| debian 14 | python-reportlab | 3.5.31-1 |
| echo | python-reportlab | 3.5.31-1 |
| Oracle Linux 7 | python-reportlab | 2.5-11.el7_9 |
| Oracle Linux 7 | python-reportlab-docs | 2.5-11.el7_9 |
| Oracle Linux 8 | python3-reportlab | 3.4.0-8.el8_8.1 |
| Red Hat | python-reportlab | pas de correctif indiqué |
| Red Hat | python-reportlab-docs | pas de correctif indiqué |
Références
- https://access.redhat.com/errata/RHSA-2023:5790
- https://access.redhat.com/security/cve/CVE-2019-19450
- https://bugzilla.redhat.com/2239920
- https://errata.almalinux.org/8/ALSA-2023-5790.html
- https://github.com/MrBitBucket/reportlab-mirror/blob/master/CHANGES.md
- https://github.com/MrBitBucket/reportlab-mirror/blob/master/CHANGES.md#release-353115102019
- https://hg.reportlab.com/hg-public/reportlab
- https://linux.oracle.com/cve/CVE-2019-19450.html
Les 17 références
- https://linux.oracle.com/errata/ELSA-2023-5790.html
- https://lists.debian.org/debian-lts-announce/2023/09/msg00037.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHMCB2GJQKFMGVO5RWHN222NQL5XYPHZ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHMCB2GJQKFMGVO5RWHN222NQL5XYPHZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HADPTB3SBU7IVRMDK7OL6WSQRU5AFWDZ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HADPTB3SBU7IVRMDK7OL6WSQRU5AFWDZ/
- https://nvd.nist.gov/vuln/detail/CVE-2019-19450
- https://pastebin.com/5MicRrr4
- https://www.cve.org/CVERecord?id=CVE-2019-19450