Skip to content
OpenAdvisories
High ALAS2-2023-2285 1 CVE

Important: python-reportlab security update (Amazon Linux 2)

Published Sep 27, 2023 · Updated Oct 5, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-19450: paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2 python-reportlab 0:2.5-10.amzn2.0.1
Amazon Linux · 2 python-reportlab-debuginfo 0:2.5-10.amzn2.0.1
Amazon Linux · 2 python-reportlab-docs 0:2.5-10.amzn2.0.1

Vulnerabilities 1

  • Critical 9.8
    CVE-2019-19450

    ReportLab vulnerable to remote code execution via paraparser

    paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue t…

    reportlab python-reportlab python-reportlab Debian Ubuntu PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-19450.html