python-reportlab: CVE-2019-17626: remote code execution in colors.py

Debian Bug report logs - #942763
python-reportlab: CVE-2019-17626: remote code execution in colors.py

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Hugo Lefeuvre <hle@debian.org>

To: submit@bugs.debian.org

Subject: python-reportlab: CVE-2019-17626: remote code execution in colors.py

Date: Mon, 21 Oct 2019 10:20:37 +0200

[Message part 1 (text/plain, inline)]

Source: python-reportlab
Version: 3.5.28-1
Severity: important
Tags: security upstream
Forwarded: https://bitbucket.org/rptlab/reportlab/issues/199/eval-in-colorspy-leads-to-remote-code

Hi,

python-reportlab is affected by the following vulnerability:

CVE-2019-17626[0]: "ReportLab through 3.5.26 allows remote code execution
because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted
XML document with '<span color="' followed by arbitrary Python code."

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-17626

regards,
Hugo

-- 
                Hugo Lefeuvre (hle)    |    www.owl.eu.com
RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD
ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.