kritik
CVE-2019-19450
python-reportlab: code injection in paraparser.py allows code execution
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA. Daha düşük diyenler: Red Hat (yüksek), AlmaLinux (yüksek), Amazon (yüksek), Oracle (yüksek).
Açıklama
paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| pip::GitHub Security Advisory pip | reportlab | 3.5.31 |
| alma 8 | python3-reportlab | 3.4.0-8.el8_8.1.alma.1 |
| amazon linux 2 | python-reportlab, python-reportlab-debuginfo, python-reportlab-docs | 2.5-10.amzn2.0.1 |
| debian 10 | python-reportlab | 3.5.13-1+deb10u2 |
| debian 11 | python-reportlab | 3.5.31-1 |
| debian 12 | python-reportlab | 3.5.31-1 |
| debian 13 | python-reportlab | 3.5.31-1 |
| debian 14 | python-reportlab | 3.5.31-1 |
| echo | python-reportlab | 3.5.31-1 |
| Oracle Linux 7 | python-reportlab, python-reportlab-docs | 2.5-11.el7_9 |
| Oracle Linux 8 | python3-reportlab | 3.4.0-8.el8_8.1 |
| Red Hat | python-reportlab, python-reportlab-docs | düzeltme belirtilmemiş |
12 kaynaktaki 16 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| pip::GitHub Security Advisory pip | reportlab | 3.5.31 |
| alma 8 | python3-reportlab | 3.4.0-8.el8_8.1.alma.1 |
| amazon linux 2 | python-reportlab | 2.5-10.amzn2.0.1 |
| amazon linux 2 | python-reportlab-debuginfo | 2.5-10.amzn2.0.1 |
| amazon linux 2 | python-reportlab-docs | 2.5-10.amzn2.0.1 |
| debian 10 | python-reportlab | 3.5.13-1+deb10u2 |
| debian 11 | python-reportlab | 3.5.31-1 |
| debian 12 | python-reportlab | 3.5.31-1 |
| debian 13 | python-reportlab | 3.5.31-1 |
| debian 14 | python-reportlab | 3.5.31-1 |
| echo | python-reportlab | 3.5.31-1 |
| Oracle Linux 7 | python-reportlab | 2.5-11.el7_9 |
| Oracle Linux 7 | python-reportlab-docs | 2.5-11.el7_9 |
| Oracle Linux 8 | python3-reportlab | 3.4.0-8.el8_8.1 |
| Red Hat | python-reportlab | düzeltme belirtilmemiş |
| Red Hat | python-reportlab-docs | düzeltme belirtilmemiş |
Referanslar
- https://access.redhat.com/errata/RHSA-2023:5790
- https://access.redhat.com/security/cve/CVE-2019-19450
- https://bugzilla.redhat.com/2239920
- https://errata.almalinux.org/8/ALSA-2023-5790.html
- https://github.com/MrBitBucket/reportlab-mirror/blob/master/CHANGES.md
- https://github.com/MrBitBucket/reportlab-mirror/blob/master/CHANGES.md#release-353115102019
- https://hg.reportlab.com/hg-public/reportlab
- https://linux.oracle.com/cve/CVE-2019-19450.html
17 referansın hepsi
- https://linux.oracle.com/errata/ELSA-2023-5790.html
- https://lists.debian.org/debian-lts-announce/2023/09/msg00037.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHMCB2GJQKFMGVO5RWHN222NQL5XYPHZ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHMCB2GJQKFMGVO5RWHN222NQL5XYPHZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HADPTB3SBU7IVRMDK7OL6WSQRU5AFWDZ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HADPTB3SBU7IVRMDK7OL6WSQRU5AFWDZ/
- https://nvd.nist.gov/vuln/detail/CVE-2019-19450
- https://pastebin.com/5MicRrr4
- https://www.cve.org/CVERecord?id=CVE-2019-19450