Remote Code Execution Vulnerability in ReportLab Package
Summary
CVE-2019-17626: ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '. Affects python-reportlab versions < 3.5.34-1. Fixed in 3.5.34-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
ReportLab is a widely used open-source library for generating PDFs and graphics in Python. It provides a robust set of features for creating complex documents and is utilized in various applications for report generation, data visualization, and more. However, a critical vulnerability has been identified that allows remote code execution, posing significant risks to applications relying on this library.
Vulnerability Detail
The vulnerability, identified as CVE-2019-17626, arises from the use of the 'toColor' function in the 'colors.py' module of ReportLab. This function improperly handles input, allowing an attacker to inject arbitrary Python code through a crafted XML document. Specifically, the vulnerability is triggered when the input contains a '<span color="' tag followed by malicious code. The consequences of this vulnerability are severe, as it enables remote code execution, potentially compromising the entire system where the library is deployed.
How To Fix
Minimum fixed version
3.5.34-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-reportlabTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to sanitize any input that may be passed to the 'toColor' function, ensuring that it does not contain any executable code. This can be done by implementing input validation checks in your application code.
Conclusion
The CVE-2019-17626 vulnerability in the ReportLab package poses a significant risk due to its potential for remote code execution. Users are strongly advised to upgrade to the latest version of the library to mitigate this risk. For those unable to upgrade immediately, implementing input validation can serve as a temporary workaround. Tools like Vulert can assist in monitoring and alerting for such vulnerabilities.
See every vulnerability recorded for python-reportlab →
FAQ
CVE-2019-17626 is a vulnerability in the ReportLab library that allows remote code execution through improper handling of input in the 'toColor' function.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to get real-time alerts.
The primary risk is remote code execution, which can allow attackers to execute arbitrary code on the server, potentially leading to data breaches, system compromise, or service disruption.
Yes, you can implement input validation to sanitize any data passed to the 'toColor' function as a temporary measure until an upgrade can be performed.
The CVSS score for CVE-2019-17626 is 9.8, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for python-reportlab.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
