CVE-2019-19450: Critical severity reportlab vulnerability
paraparser in ReportLab before 3.5.31 allows remote code execution because startunichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-19450?
The severity of CVE-2019-19450 is critical with a severity score of 9.8.
How does CVE-2019-19450 allow remote code execution?
CVE-2019-19450 allows remote code execution through the evaluation of untrusted user input in a crafted XML document.
Which software versions are affected by CVE-2019-19450?
Versions up to and excluding 3.5.31 of ReportLab and Reportlab are affected by CVE-2019-19450.
How can I fix CVE-2019-19450?
To fix CVE-2019-19450, update ReportLab to version 3.5.31 or later.
Where can I find more information about CVE-2019-19450?
More information about CVE-2019-19450 can be found on the NIST National Vulnerability Database (NVD) page and the GitHub and Pastebin links provided.