Arbitrary Code Execution Vulnerability in ReportLab (CVE-2023-33733)
Summary
CVE-2023-33733: Reportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file. Affects python-reportlab versions < 3.5.59-2+deb11u1. Fixed in 3.5.59-2+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ReportLab is a widely used open-source library for generating PDFs in Python. It provides a robust framework for creating complex documents and graphics, making it a popular choice among developers. However, versions up to 3.6.12 are vulnerable to a critical security flaw that allows attackers to execute arbitrary code through specially crafted PDF files.
Vulnerability Detail
The vulnerability identified as CVE-2023-33733 allows attackers to exploit the ReportLab library by supplying a malicious PDF file. This flaw arises from improper handling of certain PDF structures, which can lead to arbitrary code execution on the server or client side. The ramifications of this vulnerability are severe, as it can compromise the integrity and confidentiality of the system, potentially leading to unauthorized access and data breaches.
How To Fix
Minimum fixed version
3.5.59-2+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-reportlabTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to sanitize PDF files before processing them. This can help mitigate the risk of executing malicious code. Additionally, restrict the execution environment to limit the impact of potential exploits.
Conclusion
CVE-2023-33733 poses a significant risk to users of the ReportLab library, allowing for arbitrary code execution via malicious PDF files. It is crucial to upgrade to version 3.6.13 or later to protect against this vulnerability. For those unable to upgrade immediately, implementing workarounds can help reduce the risk.
See every vulnerability recorded for python-reportlab →
FAQ
CVE-2023-33733 is a vulnerability in the ReportLab library that allows arbitrary code execution through crafted PDF files.
All versions of ReportLab up to and including 3.6.12 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of CVE-2023-33733 is 7.8, indicating a high severity level.
If you cannot upgrade immediately, implement input validation and restrict the execution environment to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for python-reportlab.
