Bug 2239920 (CVE-2019-19450)

Summary:	CVE-2019-19450 python-reportlab: code injection in paraparser.py allows code execution
Product:	[Other] Security Response	Reporter:	Zack Miele <zmiele>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	saroy, tpopela
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	reportlab 3.5.31	Doc Type:	If docs needed, set a value
Doc Text:	A code injection vulnerability was found in python-reportlab that may allow an attacker to execute code while parsing a unichar element attribute. An application that uses python-reportlab to parse untrusted input files may be vulnerable and could allow remote code execution.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2240153
Bug Blocks:	2239922

Description Zack Miele 2023-09-20 19:46:20 UTC

paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.

https://github.com/MrBitBucket/reportlab-mirror/blob/master/CHANGES.md
https://pastebin.com/5MicRrr4

Comment 3 Sandipan Roy 2023-09-22 04:29:19 UTC

Created python-reportlab tracking bugs for this issue:

Affects: fedora-all [bug 2240153]

Comment 7 Sandipan Roy 2023-09-22 11:05:58 UTC

To exploit the issue, a malicious user has to use a crafted malicious html 'unichar' tag input and then use the reportlab's feature to generate a pdf of the document and that can lead to a remote code execution hence this CVE marked as Important impact.

This vulnerability is similar to CVE-2019-17626.

Comment 8 errata-xmlrpc 2023-10-10 16:14:40 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2023:5616 https://access.redhat.com/errata/RHSA-2023:5616

Comment 9 errata-xmlrpc 2023-10-17 13:52:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support
  Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.2 Telecommunications Update Service

Via RHSA-2023:5788 https://access.redhat.com/errata/RHSA-2023:5788

Comment 10 errata-xmlrpc 2023-10-17 13:52:06 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2023:5789 https://access.redhat.com/errata/RHSA-2023:5789

Comment 11 errata-xmlrpc 2023-10-17 13:52:31 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service

Via RHSA-2023:5787 https://access.redhat.com/errata/RHSA-2023:5787

Comment 12 errata-xmlrpc 2023-10-17 13:57:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:5790 https://access.redhat.com/errata/RHSA-2023:5790

Comment 13 errata-xmlrpc 2023-10-17 13:57:06 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:5786 https://access.redhat.com/errata/RHSA-2023:5786