Vulnerability CVE-2019-17626

Vulnerability Name:

CVE-2019-17626 (CCN-169480)

Assigned:

2019-10-16

Published:

2019-10-16

Updated:

2020-07-27

Summary:

ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.

CVSS v3 Severity:

9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.9 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:R)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

7.8 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.1 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:U/RC:R)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

9.8 Critical (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.9 High (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:R)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

6.8 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

CWE-91
CWE-95

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2019-17626

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2020:0160

Source: REDHAT
Type: UNKNOWN
RHSA-2020:0195

Source: REDHAT
Type: UNKNOWN
RHSA-2020:0197

Source: REDHAT
Type: UNKNOWN
RHSA-2020:0201

Source: REDHAT
Type: UNKNOWN
RHSA-2020:0230

Source: CCN
Type: Bitbucket Web site
eval in colors.py leads to remote code execution

Source: MISC
Type: Exploit, Issue Tracking, Third Party Advisory
https://bitbucket.org/rptlab/reportlab/issues/199/eval-in-colorspy-leads-to-remote-code

Source: MISC
Type: Release Notes, Third Party Advisory
https://bitbucket.org/rptlab/reportlab/src/default/CHANGES.md

Source: XF
Type: UNKNOWN
reportlab-cve201917626-code-exec(169480)

Source: MLIST
Type: UNKNOWN
[debian-lts-announce] 20200220 [SECURITY] [DLA 2112-1] python-reportlab security update

Source: FEDORA
Type: UNKNOWN
FEDORA-2020-f3e0ba2f79

Source: FEDORA
Type: UNKNOWN
FEDORA-2020-d2fb999600

Source: GENTOO
Type: UNKNOWN
GLSA-202007-35

Source: UBUNTU
Type: UNKNOWN
USN-4273-1

Source: DEBIAN
Type: UNKNOWN
DSA-4663

Source: CCN
Type: ReportLab Web site
ReportLab

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2019-17626

Vulnerable Configuration:

Configuration 1:

cpe:/a:reportlab:reportlab:*:*:*:*:*:*:*:* (Version <= 3.5.26)

Configuration RedHat 1:

cpe:/o:redhat:enterprise_linux:7:*:*:*:*:*:*:*

Configuration RedHat 2:

cpe:/o:redhat:enterprise_linux:7::client:*:*:*:*:*

Configuration RedHat 3:

cpe:/o:redhat:enterprise_linux:7::server:*:*:*:*:*

Configuration RedHat 4:

cpe:/o:redhat:enterprise_linux:7::workstation:*:*:*:*:*

Configuration RedHat 5:

cpe:/o:redhat:enterprise_linux:6:*:*:*:*:*:*:*

Configuration RedHat 6:

cpe:/o:redhat:enterprise_linux:6::client:*:*:*:*:*

Configuration RedHat 7:

cpe:/o:redhat:enterprise_linux:6::server:*:*:*:*:*

Configuration RedHat 8:

cpe:/o:redhat:enterprise_linux:6::workstation:*:*:*:*:*

Configuration RedHat 9:

cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

Configuration RedHat 10:

cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

Configuration CCN 1:

cpe:/a:reportlab:reportlab:3.5.26:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:201917626	V	CVE-2019-17626	2022-09-02
oval:org.opensuse.security:def:3763	P	Security update for apache2 (Important)	2022-07-06
oval:org.opensuse.security:def:3058	P	dstat-0.7.3-1.11 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3073	P	g3utils-1.1.36-58.6.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3111	P	java-11-openjdk-11.0.4.0-1.26 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3751	P	perl-XML-LibXML-2.0019-6.3.5 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3103	P	hplip-3.16.11-1.33 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3423	P	aaa_base-13.2+git20140911.61c1681-38.13.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3113	P	java-1_7_1-ibm-1.7.1_sr4.50-38.41.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3026	P	bluez-5.13-5.12.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3022	P	axis-1.4-290.6.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3044	P	cups-filters-1.0.58-19.5.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3064	P	evince-3.20.2-6.27.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3097	P	guestfs-data-1.32.4-21.3.10 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3411	P	yast2-3.2.50-4.7.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3032	P	cifs-utils-6.9-9.6.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:113294	P	python36-reportlab-3.5.59-2.6 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:106706	P	python36-reportlab-3.5.59-2.6 on GA media (Moderate)	2021-10-01
oval:org.opensuse.security:def:65663	P	Security update for python39 (Important)	2021-09-03
oval:org.opensuse.security:def:47094	P	libvorbis-doc-1.3.3-8.23 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47455	P	opie-2.4-724.56 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:46945	P	gdk-pixbuf-lang-2.34.0-16.2 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47638	P	guile-2.0.9-8.3 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47183	P	xfsprogs-4.3.0-8.8 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47607	P	fetchmail-6.3.26-12.3 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47543	P	DirectFB-1.7.1-6.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:48347	P	xorg-x11-7.6_1-14.17 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47481	P	python-imaging-1.1.7-21.15 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47003	P	libXvnc1-1.6.0-12.6 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47709	P	libgcrypt20-1.6.1-16.61.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47696	P	libblkid1-2.29.2-7.14 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47241	P	dnsmasq-2.76-17.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47665	P	libIlmImf-Imf_2_1-21-2.1.0-6.3.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47601	P	ecryptfs-utils-103-8.3.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47539	P	yast2-3.2.36-1.11 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47036	P	libjavascriptcoregtk-4_0-18-2.12.5-1.12 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47767	P	libpolkit0-0.113-5.12.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47397	P	libpoppler-glib8-0.43.0-15.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:63498	P	libvncserver0-0.9.10-4.25.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:63360	P	openslp-server-2.0.0-6.15.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:64547	P	Security update for the Linux Kernel (Important)	2021-07-21
oval:org.opensuse.security:def:65573	P	Security update for xstream (Important)	2021-06-17
oval:org.opensuse.security:def:46542	P	openvswitch-2.1.2-8.14 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:46871	P	xen-4.5.1_12-2.3 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48459	P	libMagickCore-6_Q16-1-6.8.8.1-33.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:46488	P	libjavascriptcoregtk-3_0-0-2.2.7-3.26 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:46621	P	avahi-0.6.31-20.59 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:46543	P	opie-2.4-724.56 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:46678	P	hplip-3.14.6-3.14 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48405	P	dovecot22-2.2.13-2.3 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:46501	P	libopenssl1_0_0-1.0.1i-2.12 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:46487	P	libipa_hbac0-1.11.5.1-5.11 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:46813	P	perl-Config-IniFiles-2.82-3.14 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48401	P	dbus-1-glib-0.100.2-3.58 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:62879	P	systemtap-3.2-5.64 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:46557	P	ppc64-diag-2.6.7-2.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:26198	P	Security update for avahi (Moderate)	2021-02-23
oval:org.opensuse.security:def:51856	P	Security update for mutt (Important)	2020-12-07
oval:org.opensuse.security:def:62702	P	libtag-devel-1.11.1-4.6.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62678	P	libkpathsea6-6.2.3-19.4 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:63158	P	libecpg6-10.3-2.8 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:72363	P	hplip-3.19.12-1.72 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62679	P	liblouis-data-3.11.0-1.42 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:72247	P	gvfs-1.34.2.1-4.6.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:2773	P	Security update for libexif (Moderate)	2020-12-02
oval:org.opensuse.security:def:2686	P	Security update for wireshark (Moderate)	2020-12-02
oval:org.opensuse.security:def:2682	P	Security update for gnutls (Important)	2020-12-02
oval:org.opensuse.security:def:2704	P	Security update for gvfs (Important)	2020-12-02
oval:org.opensuse.security:def:2724	P	Security update for jasper (Moderate)	2020-12-02
oval:org.opensuse.security:def:2757	P	Security update for MozillaFirefox (Important)	2020-12-02
oval:org.opensuse.security:def:2692	P	Security update for MozillaFirefox (Important)	2020-12-02
oval:org.opensuse.security:def:2718	P	Security update for wavpack (Low)	2020-12-02
oval:org.opensuse.security:def:2733	P	Security update for libjpeg-turbo (Important)	2020-12-02
oval:org.opensuse.security:def:2771	P	Security update for libqt5-qtbase (Important)	2020-12-02
oval:org.opensuse.security:def:2763	P	Security update for SDL2 (Moderate)	2020-12-02
oval:org.opensuse.security:def:49540	P	libXvnc-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:64185	P	Security update for bluez (Important)	2020-12-01
oval:org.opensuse.security:def:25420	P	Security update for krb5 (Moderate)	2020-12-01
oval:org.opensuse.security:def:25574	P	Security update for MozillaFirefox (Moderate)	2020-12-01
oval:org.opensuse.security:def:49685	P	libopus-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:25560	P	Security update for openldap2 (Important)	2020-12-01
oval:org.opensuse.security:def:74613	P	Security update for python-reportlab (Important)	2020-12-01
oval:org.opensuse.security:def:24866	P	Security update for soundtouch (Moderate)	2020-12-01
oval:org.opensuse.security:def:50036	P	squid on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:50518	P	Security update for libssh (Important)	2020-12-01
oval:org.opensuse.security:def:25073	P	Security update for sqlite3 (Important)	2020-12-01
oval:org.opensuse.security:def:50785	P	Security update for ghostscript (Important)	2020-12-01
oval:org.opensuse.security:def:69010	P	Security update for python-reportlab (Important)	2020-12-01
oval:org.opensuse.security:def:50291	P	Security update for qemu (Moderate)	2020-12-01
oval:org.opensuse.security:def:50754	P	Security update for libmspack (Low)	2020-12-01
oval:org.opensuse.security:def:25212	P	Security update for squid (Important)	2020-12-01
oval:org.opensuse.security:def:50689	P	Security update for python3 (Moderate)	2020-12-01
oval:org.opensuse.security:def:52134	P	Security update for libssh2_org (Moderate)	2020-12-01
oval:org.opensuse.security:def:49218	P	libpolkit0 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:50619	P	Security update for wireshark (Moderate)	2020-12-01
oval:org.opensuse.security:def:25415	P	Security update for openldap2 (Important)	2020-12-01
oval:org.opensuse.security:def:49199	P	libncurses6-32bit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49550	P	libgypsy-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:24923	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:49794	P	ocaml-libguestfs-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:50858	P	Security update for systemd (Important)	2020-12-01
oval:org.opensuse.security:def:25131	P	Security update for bash (Important)	2020-12-01
oval:org.opensuse.security:def:50189	P	gstreamer-plugins-ugly on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:64051	P	Security update for MozillaFirefox (Moderate)	2020-12-01
oval:org.opensuse.security:def:64435	P	perl-LWP-Protocol-https on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:25270	P	Security update for libxslt (Moderate)	2020-12-01
oval:org.opensuse.security:def:64393	P	libthai-data on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49558	P	libmad-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:64291	P	lftp on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:26256	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:24803	P	Security update for ucode-intel (Moderate)	2020-12-01
oval:org.opensuse.security:def:25473	P	Security update for strongswan (Important)	2020-12-01
oval:org.opensuse.security:def:49539	P	libXt6-32bit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49890	P	libopenssl-1_0_0-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:52196	P	Security update for python-reportlab (Important)	2020-12-01
oval:org.opensuse.security:def:24793	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:24992	P	Security update for polkit (Important)	2020-12-01
oval:org.opensuse.security:def:26233	P	Security update for python-reportlab (Important)	2020-12-01
oval:org.opensuse.security:def:50134	P	MozillaThunderbird on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:25129	P	Security update for openssl-1_1 (Moderate)	2020-12-01
oval:org.opensuse.security:def:74487	P	Security update for munge (Moderate)	2020-12-01
oval:org.opensuse.security:def:49200	P	libnetpbm11 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:50529	P	Security update for webkit2gtk3 (Moderate)	2020-12-01
oval:org.opensuse.security:def:25618	P	Security update for python3 (Important)	2020-12-01
oval:org.opensuse.security:def:25362	P	Security update for mailman (Important)	2020-12-01
oval:org.opensuse.security:def:25516	P	Security update for file-roller (Moderate)	2020-12-01
oval:org.opensuse.security:def:49345	P	tpm2.0-tools on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:25502	P	Security update for MozillaFirefox (Important)	2020-12-01
oval:org.opensuse.security:def:68907	P	Security update for libvpx (Moderate)	2020-12-01
oval:org.opensuse.security:def:24859	P	Security update for git (Important)	2020-12-01
oval:org.opensuse.security:def:49696	P	libsrtp-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:50445	P	Security update for python (Moderate)	2020-12-01
oval:org.opensuse.security:def:24848	P	Security update for e2fsprogs (Moderate)	2020-12-01
oval:org.opensuse.security:def:25050	P	Security update for nfs-utils (Moderate)	2020-12-01
oval:org.opensuse.security:def:49951	P	krb5-plugin-kdb-ldap on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:50414	P	Security update for krb5 (Important)	2020-12-01
oval:org.opensuse.security:def:26291	P	Security update for python-reportlab (Important)	2020-12-01
oval:org.opensuse.security:def:63724	P	Security update for glib2 (Important)	2020-12-01
oval:org.opensuse.security:def:50349	P	Security update for ncurses (Important)	2020-12-01
oval:org.opensuse.security:def:51794	P	Security update for libraw (Moderate)	2020-12-01
oval:org.opensuse.security:def:25187	P	Security update for java-1_7_0-openjdk (Important)	2020-12-01
oval:org.opensuse.security:def:50279	P	Security update for mutt (Important)	2020-12-01
oval:org.opensuse.security:def:127478	P	Security update for python-reportlab (Important)	2020-02-05
oval:org.opensuse.security:def:110237	P	Security update for python-reportlab (Important)	2020-02-04
oval:org.opensuse.security:def:97994	P	Security update for python-reportlab (Important)	2020-01-29
oval:org.opensuse.security:def:104684	P	Security update for python-reportlab (Important)	2020-01-29
oval:org.opensuse.security:def:75390	P	Security update for python-reportlab (Important)	2020-01-29
oval:org.opensuse.security:def:91029	P	Security update for python-reportlab (Important)	2020-01-29
oval:com.redhat.rhsa:def:20200230	P	RHSA-2020:0230: python-reportlab security update (Important)	2020-01-27
oval:com.redhat.rhsa:def:20200201	P	RHSA-2020:0201: python-reportlab security update (Important)	2020-01-24
oval:com.redhat.rhsa:def:20200197	P	RHSA-2020:0197: python-reportlab security update (Important)	2020-01-21
oval:com.redhat.rhsa:def:20200195	P	RHSA-2020:0195: python-reportlab security update (Important)	2020-01-21
oval:com.ubuntu.disco:def:2019176260000000	V	CVE-2019-17626 on Ubuntu 19.04 (disco) - medium.	2019-10-16
oval:com.ubuntu.bionic:def:2019176260000000	V	CVE-2019-17626 on Ubuntu 18.04 LTS (bionic) - medium.	2019-10-16
oval:com.ubuntu.xenial:def:2019176260000000	V	CVE-2019-17626 on Ubuntu 16.04 LTS (xenial) - medium.	2019-10-16

BACK