GitHub Advisoryadvisory · PyPI

GHSA-pj98-2xf6-cff5 ReportLab vulnerable to remote code execution via paraparser

CRITICAL Published 2023-09-20 Modified 2024-04-28 Official page ↗
Aliases
CVE-2019-19450
Ecosystem
PyPI
Packages
reportlab
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-91
Reviewed
2023-09-21

Affected packages

• PyPI reportlab: < 3.5.31 → fixed in 3.5.31

Description

paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.

Related

Alias · CVE (1)

  • CVE-2019-19450 paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in… vulnerability

Weakness · CWE (1)

  • CWE-91 XML Injection weakness

References