Reportlab vulnerable to remote code execution

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2023-33733 · ADVISORY
• c53elyas/CVE-2023-33733 · WEB
• lists.debian.org/debian-lts-announce/2024/10/msg00008.html · WEB
• lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36WOY22ECJCPOXHVTNCHEWOQLL7JSWP4 · WEB
• lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ALE727IRACYBTTOFIFG57RS4OA2SHIJ · WEB
• lists.fedoraproject.org/archives/list/[email protected]/message/36WOY22ECJCPOXHVTNCHEWOQLL7JSWP4 · WEB
• lists.fedoraproject.org/archives/list/[email protected]/message/6ALE727IRACYBTTOFIFG57RS4OA2SHIJ · WEB
• lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36WOY22ECJCPOXHVTNCHEWOQLL7JSWP4
• lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ALE727IRACYBTTOFIFG57RS4OA2SHIJ
• pypi.org/project/reportlab · PACKAGE
• GitHub Advisory GHSA-9q9m-c65c-37pq · ADVISORY

reportlab のその他の脆弱性

• CVE-2019-19450緊急 9.8paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in …
• CVE-2020-28463中 6.5All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSch…
• CVE-2019-17626緊急 9.8ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document …