Veracode Vulnerability DatabaseVERACODE:43579Remote Code Execution (RCE)
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.006 Low
EPSS
Percentile
78.9%
python-reportlab is vulnerable to Remote Code Execution (RCE). A remote code execution is possible because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with <unichar code=" followed by arbitrary Python code.
| CPE | Name | Operator | Version |
|---|---|---|---|
| python-reportlab:buster | eq | 3.5.13-1+deb10u1 | |
| python-reportlab:buster | eq | 3.5.13-1+deb10u1 |
References
github.com/MrBitBucket/reportlab-mirror/blob/master/CHANGES.md
lists.debian.org/debian-lts-announce/2023/09/msg00037.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHMCB2GJQKFMGVO5RWHN222NQL5XYPHZ/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HADPTB3SBU7IVRMDK7OL6WSQRU5AFWDZ/
pastebin.com/5MicRrr4
security-tracker.debian.org/tracker/CVE-2019-19450
Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.006 Low
EPSS
Percentile
78.9%