Ubuntu 4273-1: Moderate Severity Python-ReportLab RCE Threat

ubuntu

February 6, 2020

ReportLab could be made to run programs as your login if it opened a specially crafted file.

Summary

ReportLab could be made to run programs as your login if it opened a

specially crafted file.

Software Description:

- python-reportlab: library to create PDF documents

Details:

It was discovered that ReportLab incorrectly handled certain XML documents.

If a user or automated system were tricked into processing a specially

crafted document, a remote attacker could possibly use this issue to

execute arbitrary code.

Topics Covered

security advisory remote code execution arbitrary code execution ubuntu python-reportlab

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.10:
  python-reportlab                3.5.23-1ubuntu0.1
  python3-reportlab               3.5.23-1ubuntu0.1

Ubuntu 18.04 LTS:
  python-reportlab                3.4.0-3ubuntu0.1
  python3-reportlab               3.4.0-3ubuntu0.1

Ubuntu 16.04 LTS:
  python-reportlab                3.3.0-1ubuntu0.1
  python3-reportlab               3.3.0-1ubuntu0.1

In general, a standard system update will make all the necessary changes.