Описание
Security update for python-reportlab
This update for python-reportlab fixes the following issues:
- CVE-2019-17626: Fixed a potential remote code execution because of the lack of input sanitization in toColor() (bsc#1154370).
This update was imported from the SUSE:SLE-15:Update update project.
Список пакетов
openSUSE Leap 15.1
python2-reportlab-3.4.0-lp151.3.3.1
python3-reportlab-3.4.0-lp151.3.3.1
Ссылки
- E-Mail link for openSUSE-SU-2020:0160-1
- SUSE Security Ratings
- SUSE Bug 1154370
- SUSE CVE CVE-2019-17626 page
Описание
ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.
Затронутые продукты
openSUSE Leap 15.1:python2-reportlab-3.4.0-lp151.3.3.1
openSUSE Leap 15.1:python3-reportlab-3.4.0-lp151.3.3.1
Ссылки
- CVE-2019-17626
- SUSE Bug 1154370
- SUSE Bug 1215560