REDHAT-BUG-1769661: High severity reportlab vulnerability
A vulnerability was found in ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.
Reference: https://bitbucket.org/rptlab/reportlab/issues/199/eval-in-colorspy-leads-to-remote-code https://bitbucket.org/rptlab/reportlab/src/default/CHANGES.md
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1769661?
REDHAT-BUG-1769661 has been classified as a critical vulnerability due to the potential for remote code execution.
How do I fix REDHAT-BUG-1769661?
To fix REDHAT-BUG-1769661, upgrade ReportLab to version 3.5.27 or later.
Which versions of ReportLab are affected by REDHAT-BUG-1769661?
Versions up to and including ReportLab 3.5.26 are affected by REDHAT-BUG-1769661.
What kind of attack does REDHAT-BUG-1769661 allow?
REDHAT-BUG-1769661 allows remote code execution through crafted XML documents.
Is user interaction required to exploit REDHAT-BUG-1769661?
Yes, user interaction is required as the vulnerability relies on processing specially crafted XML documents.