Описание
ELSA-2020-0197: python-reportlab security update (IMPORTANT)
[2.3-3.el6_10.1]
- Do not eval strings passed to toColor
- Resolves: #1788551
Обновленные пакеты
Oracle Linux 6
Oracle Linux x86_64
python-reportlab
2.3-3.el6_10.1
python-reportlab-docs
2.3-3.el6_10.1
Oracle Linux i686
python-reportlab
2.3-3.el6_10.1
python-reportlab-docs
2.3-3.el6_10.1
Связанные CVE
Связанные уязвимости
ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.
ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.
ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.
ReportLab through 3.5.26 allows remote code execution because of toCol ...
