CVE-2019-17626

NameCVE-2019-17626
DescriptionReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severityhigh
Debian Bugs942763

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python-reportlab (PTS)jessie3.1.8-3+deb8u1vulnerable
stretch3.3.0-2vulnerable
buster3.5.13-1vulnerable
bullseye, sid3.5.31-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python-reportlabsource(unstable)(unfixed)942763

Notes

https://bitbucket.org/rptlab/reportlab/issues/199/eval-in-colorspy-leads-to-remote-code

Search for package or bug name: Reporting problems