CVE-2019-17626

NameCVE-2019-17626
DescriptionReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-2112-1, DSA-4663-1
NVD severityhigh
Debian Bugs942763

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python-reportlab (PTS)jessie3.1.8-3+deb8u1vulnerable
jessie (security)3.1.8-3+deb8u2fixed
stretch3.3.0-2vulnerable
stretch (security)3.3.0-2+deb9u1fixed
buster, buster (security)3.5.13-1+deb10u1fixed
bullseye, sid3.5.34-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python-reportlabsource(unstable)3.5.34-1942763
python-reportlabsourcebuster3.5.13-1+deb10u1DSA-4663-1
python-reportlabsourcejessie3.1.8-3+deb8u2DLA-2112-1
python-reportlabsourcestretch3.3.0-2+deb9u1DSA-4663-1

Notes

https://bitbucket.org/rptlab/reportlab/issues/199/eval-in-colorspy-leads-to-remote-code
Minimal patch in https://bitbucket.org/rptlab/reportlab/issues/199/eval-in-colorspy-leads-to-remote-code#comment-55887892
but upstream did make the bugreport private.

Search for package or bug name: Reporting problems