paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.

According to the versions of the python-reportlab package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py     evaluates untrusted user input in a unichar element in a crafted XML document with 'unichar code=''     followed by arbitrary Python code, a similar issue to CVE-2019-17626.(CVE-2019-19450)

Tenable has extracted the preceding description block directly from the EulerOS python-reportlab security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-dc844d0669 advisory.

  - paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py     evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code='     followed by arbitrary Python code, a similar issue to CVE-2019-17626. (CVE-2019-19450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-6ec4e78241 advisory.

  - paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py     evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code='     followed by arbitrary Python code, a similar issue to CVE-2019-17626. (CVE-2019-19450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2023:5790 advisory.

  - paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py     evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code='     followed by arbitrary Python code, a similar issue to CVE-2019-17626. (CVE-2019-19450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5616 advisory.

  - paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py     evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code='     followed by arbitrary Python code, a similar issue to CVE-2019-17626. (CVE-2019-19450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2023:5790 advisory.

  - paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py     evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code='     followed by arbitrary Python code, a similar issue to CVE-2019-17626. (CVE-2019-19450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-5790 advisory.

  - paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py     evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code='     followed by arbitrary Python code, a similar issue to CVE-2019-17626. (CVE-2019-19450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:5786 advisory.

  - python-reportlab: code injection in paraparser.py allows code execution (CVE-2019-19450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:5788 advisory.

  - python-reportlab: code injection in paraparser.py allows code execution (CVE-2019-19450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:5789 advisory.

  - python-reportlab: code injection in paraparser.py allows code execution (CVE-2019-19450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:5787 advisory.

  - python-reportlab: code injection in paraparser.py allows code execution (CVE-2019-19450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:5790 advisory.

  - python-reportlab: code injection in paraparser.py allows code execution (CVE-2019-19450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:4048-1 advisory.

  - paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py     evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code='     followed by arbitrary Python code, a similar issue to CVE-2019-17626. (CVE-2019-19450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-5616 advisory.

  - paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py     evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code='     followed by arbitrary Python code, a similar issue to CVE-2019-17626. (CVE-2019-19450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5616 advisory.

  - python-reportlab: code injection in paraparser.py allows code execution (CVE-2019-19450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of python-reportlab installed on the remote host is prior to 2.5-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2285 advisory.

  - paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py     evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code='     followed by arbitrary Python code, a similar issue to CVE-2019-17626. (CVE-2019-19450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2023:3972-1 advisory.

  - paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py     evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code='     followed by arbitrary Python code, a similar issue to CVE-2019-17626. (CVE-2019-19450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3590 advisory.

  - ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as     demonstrated by a crafted XML document with '<span color=' followed by arbitrary Python code.
    (CVE-2019-17626)

  - paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py     evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code='     followed by arbitrary Python code, a similar issue to CVE-2019-17626. (CVE-2019-19450)

  - All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In     order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to     reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos ->     odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img     src=http://127.0.0.1:5000 valign=top/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py     6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7.
    dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF     (CVE-2020-28463)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
205031	EulerOS 2.0 SP5 : python-reportlab (EulerOS-SA-2024-2075)	Nessus	Huawei Local Security Checks	critical
194586	Fedora 40 : python-reportlab (2024-dc844d0669)	Nessus	Fedora Local Security Checks	critical
194346	Fedora 39 : python-reportlab (2024-6ec4e78241)	Nessus	Fedora Local Security Checks	critical
190160	CentOS 8 : python-reportlab (CESA-2023:5790)	Nessus	CentOS Local Security Checks	critical
187754	CentOS 7 : python-reportlab (RHSA-2023:5616)	Nessus	CentOS Local Security Checks	critical
183421	AlmaLinux 8 : python-reportlab (ALSA-2023:5790)	Nessus	Alma Linux Local Security Checks	critical
183387	Oracle Linux 8 : python-reportlab (ELSA-2023-5790)	Nessus	Oracle Linux Local Security Checks	critical
183262	RHEL 8 : python-reportlab (RHSA-2023:5786)	Nessus	Red Hat Local Security Checks	critical
183261	RHEL 8 : python-reportlab (RHSA-2023:5788)	Nessus	Red Hat Local Security Checks	critical
183254	RHEL 8 : python-reportlab (RHSA-2023:5789)	Nessus	Red Hat Local Security Checks	critical
183253	RHEL 8 : python-reportlab (RHSA-2023:5787)	Nessus	Red Hat Local Security Checks	critical
183252	RHEL 8 : python-reportlab (RHSA-2023:5790)	Nessus	Red Hat Local Security Checks	critical
183016	SUSE SLED12 / SLES12 Security Update : python-reportlab (SUSE-SU-2023:4048-1)	Nessus	SuSE Local Security Checks	critical
182867	Oracle Linux 7 : python-reportlab (ELSA-2023-5616)	Nessus	Oracle Linux Local Security Checks	critical
182825	RHEL 7 : python-reportlab (RHSA-2023:5616)	Nessus	Red Hat Local Security Checks	critical
182629	Amazon Linux 2 : python-reportlab (ALAS-2023-2285)	Nessus	Amazon Linux Local Security Checks	critical
182573	openSUSE 15 Security Update : python-reportlab (SUSE-SU-2023:3972-1)	Nessus	SuSE Local Security Checks	critical
182381	Debian DLA-3590-1 : python-reportlab - LTS security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2019-19450

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical