Red Hat Security AdvisoryRHSA-2020:0195
python-reportlab security update
Released 2020-01-21 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) python-reportlab-2.5-9.el7_7.1
- Red Hat Enterprise Linux Client Optional (v. 7) python-reportlab-docs-2.5-9.el7_7.1
- Red Hat Enterprise Linux Server (v. 7) python-reportlab-2.5-9.el7_7.1
- Red Hat Enterprise Linux Server Optional (v. 7) python-reportlab-docs-2.5-9.el7_7.1
- Red Hat Enterprise Linux Workstation (v. 7) python-reportlab-2.5-9.el7_7.1
- Red Hat Enterprise Linux Workstation Optional (v. 7) python-reportlab-docs-2.5-9.el7_7.1
Fixes 1 record
Priority MEDIUM 61
ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.09526 · Published 2019-10-16 · Partial fix · 3.5.28 CWE-91
