==========================================================================
Ubuntu Security Notice USN-4273-1
February 06, 2020
python-reportlab vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 19.10
– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS
Summary:
ReportLab could be made to run programs as your login if it opened a
specially crafted file.
Software Description:
– python-reportlab: library to create PDF documents
Details:
It was discovered that ReportLab incorrectly handled certain XML documents.
If a user or automated system were tricked into processing a specially
crafted document, a remote attacker could possibly use this issue to
execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 19.10:
python-reportlab 3.5.23-1ubuntu0.1
python3-reportlab 3.5.23-1ubuntu0.1
Ubuntu 18.04 LTS:
python-reportlab 3.4.0-3ubuntu0.1
python3-reportlab 3.4.0-3ubuntu0.1
Ubuntu 16.04 LTS:
python-reportlab 3.3.0-1ubuntu0.1
python3-reportlab 3.3.0-1ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4273-1
CVE-2019-17626
Package Information:
https://launchpad.net/ubuntu/+source/python-reportlab/3.5.23-1ubuntu0.1
https://launchpad.net/ubuntu/+source/python-reportlab/3.4.0-3ubuntu0.1
https://launchpad.net/ubuntu/+source/python-reportlab/3.3.0-1ubuntu0.1
—–BEGIN PGP SIGNATURE—–
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl48cvwACgkQZWnYVadE
vpOhKg//W7s1FQz0W2UVvDk3lC5lTtfg1jsmZcA+o2DIM5QRX4qTQf0RIn/tqpUE
l3I2A4R+1XC8KsYE52tF79sCQX3xRMC0BPD8ONMg+Og3X1hRSsg+s+ZaRrS2iMBk
I8XZMkxzoR/d1182XK0Paq6P+M92owkBLFABXdFyaHUeBDcKDbvqj7Kcw4n7+jDn
rDAlh3JIxk4Z5BqMbNKF6TzfqVbNq2x0MfLknCdZ7mnjQfh49rjpJAD6cTqFIgQm
3mCq+KhQUh0dAIH1xeoyuDgl84Uh5d8zLap08bCgGiqpWtTG0qhZSuiCSKoNzYmq
AbKgEDFUCVTtjT/g5X+YuzgVsXhebmdiHV/Hdyo4JDxsqhgqqPH6OSRdOiWqtQBC
uxD+/WQvNek2NLPTC8l3vFeoik6fGfOj6AjPK5aYhtw4nWTRWaosuuYPGWijCpeG
1RoWASIpLCw26iARH2Y9scqM9JEKKcZJA0ug7OYBHgGG/Edl6GFuzFjMDf7DZjxL
kXMMkflEhpiVzrFfZ7S11IvHS/C5EqdyBvusKsz28nxwkHByRpjWaXApHZAjfPLz
dKRhk/jqbMrrK7WvX7v40mfFhUT/aD3X8P7P5dHZq49BWkV0GTygt0npd0tCjGJo
7qdSIq4si7L4RMW/8Y6mklbQof9vLUaN9s4zHBWiW1VtOlyju8A=
=1Gxc
—–END PGP SIGNATURE—–
—
