paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.

According to the versions of the python-reportlab package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py     evaluates untrusted user input in a unichar element in a crafted XML document with 'unichar code=''     followed by arbitrary Python code, a similar issue to CVE-2019-17626.(CVE-2019-19450)

Tenable has extracted the preceding description block directly from the EulerOS python-reportlab security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-dc844d0669 advisory.

    - Release 4.2.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-6ec4e78241 advisory.

    - Release 4.2.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2023:5790 advisory.

  - paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py     evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code='     followed by arbitrary Python code, a similar issue to CVE-2019-17626. (CVE-2019-19450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5616 advisory.

  - paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py     evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code='     followed by arbitrary Python code, a similar issue to CVE-2019-17626. (CVE-2019-19450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2023:5790 advisory.

  - paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py     evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code='     followed by arbitrary Python code, a similar issue to CVE-2019-17626. (CVE-2019-19450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-5790 advisory.

    [3.4.0-8.1]
    - python-reportlab: code injection in paraparser.py allows code execution (CVE-2019-19450)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:5786 advisory.

    Python-reportlab is a library used for generation of PDF documents.

    Security Fix(es):

    * python-reportlab: code injection in paraparser.py allows code execution (CVE-2019-19450)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:5788 advisory.

    Python-reportlab is a library used for generation of PDF documents.

    Security Fix(es):

    * python-reportlab: code injection in paraparser.py allows code execution (CVE-2019-19450)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:5789 advisory.

    Python-reportlab is a library used for generation of PDF documents.

    Security Fix(es):

    * python-reportlab: code injection in paraparser.py allows code execution (CVE-2019-19450)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:5787 advisory.

    Python-reportlab is a library used for generation of PDF documents.

    Security Fix(es):

    * python-reportlab: code injection in paraparser.py allows code execution (CVE-2019-19450)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:5790 advisory.

    Python-reportlab is a library used for generation of PDF documents.

    Security Fix(es):

    * python-reportlab: code injection in paraparser.py allows code execution (CVE-2019-19450)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:4048-1 advisory.

  - paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py     evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code='     followed by arbitrary Python code, a similar issue to CVE-2019-17626. (CVE-2019-19450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-5616 advisory.

    [2.5-11]
    - Do not evaluate unichar element
    - Resolves: RHEL-7011

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5616 advisory.

    Python-reportlab is a library used for generation of PDF documents.

    Security Fix(es):

    * python-reportlab: code injection in paraparser.py allows code execution (CVE-2019-19450)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of python-reportlab installed on the remote host is prior to 2.5-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2285 advisory.

    paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py     evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code='     followed by arbitrary Python code, a similar issue to CVE-2019-17626. (CVE-2019-19450)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2023:3972-1 advisory.

  - paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py     evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code='     followed by arbitrary Python code, a similar issue to CVE-2019-17626. (CVE-2019-19450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3590 advisory.

  - ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as     demonstrated by a crafted XML document with '<span color=' followed by arbitrary Python code.
    (CVE-2019-17626)

  - paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py     evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code='     followed by arbitrary Python code, a similar issue to CVE-2019-17626. (CVE-2019-19450)

  - All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In     order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to     reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos ->     odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img     src=http://127.0.0.1:5000 valign=top/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py     6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7.
    dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF     (CVE-2020-28463)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
205031	EulerOS 2.0 SP5 : python-reportlab (EulerOS-SA-2024-2075)	Nessus	Huawei Local Security Checks	critical
196040	RHEL 6 : python-reportlab (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
194586	Fedora 40 : python-reportlab (2024-dc844d0669)	Nessus	Fedora Local Security Checks	critical
194346	Fedora 39 : python-reportlab (2024-6ec4e78241)	Nessus	Fedora Local Security Checks	critical
190160	CentOS 8 : python-reportlab (CESA-2023:5790)	Nessus	CentOS Local Security Checks	critical
187754	CentOS 7 : python-reportlab (RHSA-2023:5616)	Nessus	CentOS Local Security Checks	critical
183421	AlmaLinux 8 : python-reportlab (ALSA-2023:5790)	Nessus	Alma Linux Local Security Checks	critical
183387	Oracle Linux 8 : python-reportlab (ELSA-2023-5790)	Nessus	Oracle Linux Local Security Checks	critical
183262	RHEL 8 : python-reportlab (RHSA-2023:5786)	Nessus	Red Hat Local Security Checks	critical
183261	RHEL 8 : python-reportlab (RHSA-2023:5788)	Nessus	Red Hat Local Security Checks	critical
183254	RHEL 8 : python-reportlab (RHSA-2023:5789)	Nessus	Red Hat Local Security Checks	critical
183253	RHEL 8 : python-reportlab (RHSA-2023:5787)	Nessus	Red Hat Local Security Checks	critical
183252	RHEL 8 : python-reportlab (RHSA-2023:5790)	Nessus	Red Hat Local Security Checks	critical
183016	SUSE SLED12 / SLES12 Security Update : python-reportlab (SUSE-SU-2023:4048-1)	Nessus	SuSE Local Security Checks	critical
182867	Oracle Linux 7 : python-reportlab (ELSA-2023-5616)	Nessus	Oracle Linux Local Security Checks	critical
182825	RHEL 7 : python-reportlab (RHSA-2023:5616)	Nessus	Red Hat Local Security Checks	critical
182629	Amazon Linux 2 : python-reportlab (ALAS-2023-2285)	Nessus	Amazon Linux Local Security Checks	critical
182573	openSUSE 15 Security Update : python-reportlab (SUSE-SU-2023:3972-1)	Nessus	SuSE Local Security Checks	critical
182381	Debian DLA-3590-1 : python-reportlab - LTS security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2019-19450

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical