CVE-2019-19450

Advisory

ReportLab 3.5.31 includes a fix for CVE-2019-19450: Paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.
https://github.com/MrBitBucket/reportlab-mirror/blob/master/CHANGES.md#release-353115102019

Affected package

Affected versions

Fixed versions

Vulnerability changelog

paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626. See CVE-2019-19450.


MISC:https://github.com/MrBitBucket/reportlab-mirror/blob/master/CHANGES.md: https://github.com/MrBitBucket/reportlab-mirror/blob/master/CHANGES.md
MISC:https://pastebin.com/5MicRrr4: https://pastebin.com/5MicRrr4

Resources

• https://github.com/MrBitBucket/reportlab-mirror/blob/master/CHANGES.md
• https://pastebin.com/5MicRrr4
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19450
• https://lists.debian.org/debian-lts-announce/2023/09/msg00037.html