Skip to content
OpenAdvisories
Critical DLA-3590-1 2 CVEs

python-reportlab - security update

Published Sep 29, 2023 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 10 python-reportlab 3.5.13-1+deb10u2

Vulnerabilities 2

  • Critical 9.8
    CVE-2019-19450

    ReportLab vulnerable to remote code execution via paraparser

    paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue t…

    reportlab python-reportlab python-reportlab Debian Ubuntu PyPI
  • Medium 6.5
    CVE-2020-28463

    Server-side Request Forgery (SSRF)

    All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the l…

    reportlab python-reportlab python-reportlab Debian Ubuntu PyPI