High ELSA-2020-0201 1 CVE

Important: python-reportlab security update (Oracle Linux 8)

Published Jan 22, 2020 · Updated Jan 22, 2020

Ecosystem: Oracle Linux

Summary

[3.4.0-6.el8_1_0.2]
- Fix Requires for doc subpackage
- Resolves: #1788556

[3.4.0-6.el8_1_0.1]
- Do not eval strings passed to toColor
- Resolves: #1788555

Fixed packages 1

Release	Package	Fixed in
Oracle Linux · 8	python3-reportlab	0:3.4.0-6.el8_1.2

Vulnerabilities 1

Critical 9.8

CVE-2019-17626

XML Injection in ReportLab

ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.

reportlab python-reportlab python-reportlab Debian Ubuntu PyPI

Oct 16, 2019