Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.0231
python-reportlab security update
23 January 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: python-reportlab
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux Server 7
Red Hat Enterprise Linux WS/Desktop 7
Red Hat Enterprise Linux Server 6
Red Hat Enterprise Linux WS/Desktop 6
Red Hat Enterprise Linux Server 8
Red Hat Enterprise Linux WS/Desktop 8
UNIX variants (UNIX, Linux, OSX)
Windows
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2019-17626
Original Bulletin:
https://access.redhat.com/errata/RHSA-2020:0195
https://access.redhat.com/errata/RHSA-2020:0197
https://access.redhat.com/errata/RHSA-2020:0201
Comment: This bulletin contains three (3) Red Hat security advisories.
This advisory references vulnerabilities in products which run on
platforms other than Red Hat. It is recommended that administrators
running python-reportlab check for an updated version of the
software for their operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: python-reportlab security update
Advisory ID: RHSA-2020:0195-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:0195
Issue date: 2020-01-21
CVE Names: CVE-2019-17626
=====================================================================
1. Summary:
An update for python-reportlab is now available for Red Hat Enterprise
Linux 7.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Client (v. 7) - x86_64
Red Hat Enterprise Linux Client Optional (v. 7) - x86_64
Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 7) - x86_64
Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64
3. Description:
Python-reportlab is a library used for generation of PDF documents.
Security Fix(es):
* python-reportlab: code injection in colors.py allows attacker to execute
code (CVE-2019-17626)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1769661 - CVE-2019-17626 python-reportlab: code injection in colors.py allows attacker to execute code
6. Package List:
Red Hat Enterprise Linux Client (v. 7):
Source:
python-reportlab-2.5-9.el7_7.1.src.rpm
x86_64:
python-reportlab-2.5-9.el7_7.1.x86_64.rpm
python-reportlab-debuginfo-2.5-9.el7_7.1.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
x86_64:
python-reportlab-debuginfo-2.5-9.el7_7.1.x86_64.rpm
python-reportlab-docs-2.5-9.el7_7.1.x86_64.rpm
Red Hat Enterprise Linux Server (v. 7):
Source:
python-reportlab-2.5-9.el7_7.1.src.rpm
ppc64:
python-reportlab-2.5-9.el7_7.1.ppc64.rpm
python-reportlab-debuginfo-2.5-9.el7_7.1.ppc64.rpm
ppc64le:
python-reportlab-2.5-9.el7_7.1.ppc64le.rpm
python-reportlab-debuginfo-2.5-9.el7_7.1.ppc64le.rpm
s390x:
python-reportlab-2.5-9.el7_7.1.s390x.rpm
python-reportlab-debuginfo-2.5-9.el7_7.1.s390x.rpm
x86_64:
python-reportlab-2.5-9.el7_7.1.x86_64.rpm
python-reportlab-debuginfo-2.5-9.el7_7.1.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 7):
ppc64:
python-reportlab-debuginfo-2.5-9.el7_7.1.ppc64.rpm
python-reportlab-docs-2.5-9.el7_7.1.ppc64.rpm
ppc64le:
python-reportlab-debuginfo-2.5-9.el7_7.1.ppc64le.rpm
python-reportlab-docs-2.5-9.el7_7.1.ppc64le.rpm
s390x:
python-reportlab-debuginfo-2.5-9.el7_7.1.s390x.rpm
python-reportlab-docs-2.5-9.el7_7.1.s390x.rpm
x86_64:
python-reportlab-debuginfo-2.5-9.el7_7.1.x86_64.rpm
python-reportlab-docs-2.5-9.el7_7.1.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 7):
Source:
python-reportlab-2.5-9.el7_7.1.src.rpm
x86_64:
python-reportlab-2.5-9.el7_7.1.x86_64.rpm
python-reportlab-debuginfo-2.5-9.el7_7.1.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 7):
x86_64:
python-reportlab-debuginfo-2.5-9.el7_7.1.x86_64.rpm
python-reportlab-docs-2.5-9.el7_7.1.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2019-17626
https://access.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXid8ItzjgjWX9erEAQhOtQ//XiIlyjkbyGZ5ag796zNYx055kwZJmRbA
r2ClZviWlw6F2gmJCcGXQqMAIPOnl+AYwVnJwrN5Lb1YFgJRq/UyB8B0mjeEPQug
KS6cZ/t3x1/gAlHzM8zkjPat1xxDvuvskHFWg3e+eziMRojT5QF1NiCjm2kNWDV7
sKR4p5W3x/UaLa7Q6Jw2DJSZUXsv2xHhbQmtQgWiaU5kWs5vaXy0t+j7kReR1fr0
+TlgIoDz+TI1kJhDcF4q1SZ0EkOg8Kg628EWaIlY3DXypMx5f3AKtn8X08vjh03G
+mcNPWsy/72PhBJvWciONFe45xK4C4CQgYXh8MKv7mf4UAZPiz1dsPXSx0iFQrQc
DfuIIjxC8Y4cOk6wOzFpxkP+cntTx6omfIKbF0Ej62V46lpXoLfYBgcZuz0tabIT
WtKC2CVLkf9EzTLpuoIbj4OyfyIHaUJ/YlCNqcTlTmqe+Pe1r6s+NcUcnYj88ktK
GZ5jR7qDl1QgZwxBWKKU4UPXbcqKkz4pkznEdCzPrVJgYL3nufeIvNDfw8zsoP2j
hqXMOLX/OQBCWl2v9PjzVWwtl37I+AOkg2MlXcj7v8d8ZoZWlUNZQMfs8T+OIfnS
dROwORB7Qfmnre566UcNNYexRT2LRzumfnIklRnMH0i3q5dA9hcA0kyMwZJQveN2
5/Yh7jxk74Y=
=LhAs
- -----END PGP SIGNATURE-----
- ----------------------------------------------------------------------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: python-reportlab security update
Advisory ID: RHSA-2020:0197-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:0197
Issue date: 2020-01-21
CVE Names: CVE-2019-17626
=====================================================================
1. Summary:
An update for python-reportlab is now available for Red Hat Enterprise
Linux 6.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - noarch
Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - noarch
Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) - noarch
3. Description:
Python-reportlab is a library used for generation of PDF documents.
Security Fix(es):
* python-reportlab: code injection in colors.py allows attacker to execute
code (CVE-2019-17626)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1769661 - CVE-2019-17626 python-reportlab: code injection in colors.py allows attacker to execute code
6. Package List:
Red Hat Enterprise Linux Desktop (v. 6):
Source:
python-reportlab-2.3-3.el6_10.1.src.rpm
i386:
python-reportlab-2.3-3.el6_10.1.i686.rpm
python-reportlab-debuginfo-2.3-3.el6_10.1.i686.rpm
x86_64:
python-reportlab-2.3-3.el6_10.1.x86_64.rpm
python-reportlab-debuginfo-2.3-3.el6_10.1.x86_64.rpm
Red Hat Enterprise Linux Desktop Optional (v. 6):
noarch:
python-reportlab-docs-2.3-3.el6_10.1.noarch.rpm
Red Hat Enterprise Linux Server (v. 6):
Source:
python-reportlab-2.3-3.el6_10.1.src.rpm
i386:
python-reportlab-2.3-3.el6_10.1.i686.rpm
python-reportlab-debuginfo-2.3-3.el6_10.1.i686.rpm
ppc64:
python-reportlab-2.3-3.el6_10.1.ppc64.rpm
python-reportlab-debuginfo-2.3-3.el6_10.1.ppc64.rpm
x86_64:
python-reportlab-2.3-3.el6_10.1.x86_64.rpm
python-reportlab-debuginfo-2.3-3.el6_10.1.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 6):
noarch:
python-reportlab-docs-2.3-3.el6_10.1.noarch.rpm
Red Hat Enterprise Linux Workstation (v. 6):
Source:
python-reportlab-2.3-3.el6_10.1.src.rpm
i386:
python-reportlab-2.3-3.el6_10.1.i686.rpm
python-reportlab-debuginfo-2.3-3.el6_10.1.i686.rpm
x86_64:
python-reportlab-2.3-3.el6_10.1.x86_64.rpm
python-reportlab-debuginfo-2.3-3.el6_10.1.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 6):
noarch:
python-reportlab-docs-2.3-3.el6_10.1.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2019-17626
https://access.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXidOqtzjgjWX9erEAQhMQxAAmGV4iZdo3naF5MbGI3thfqAM1mY2/lBI
obLs+uFKnn+j2jRZUu/BD+Krvz5W9+WPVbWMwu97eB8wxYuG+d1sBl3f1ejlQeUY
RmCkYPbdehmGilUk+WHpi8hv0BcQtbZhIz8Q6n+v45ZdbcFqUHTe/KW4tkDXtAau
TMOQURE6H55GRlQEQA94+LMF5sjG9Kxy6IRwtna1X72yJENswSIrLUaY9weqAE9d
qkWf/k45ieQVk2ATIzcg5+m8By5vPFlle86co4w+AWLFQZk6YEf8Xy0qtnv4j4i5
53XLfyScpWBUPfOxaGSoSpLnLm4WWiRHdB9Z3cnfFVPP6kFXwY07yXDsIHONIaoo
EQzFi8wZlFG4S62jVn+mwnSDxWuqu1xx6fv9qPBo96/hqEyn41esaPBXglXH7AnV
n3rRJMnZdU1salqMZ8DT7rnkXuCI4nOT58uNSLVdJ1HCUHs6QdvOovA88Zj6r6pm
d1O6MzxDfm/S32uWBquJWzm0bMCH/pAU1XqYsEcLvriUSxUwmsrrMa55GMwgeADK
Vxas2kjEh3SG6fNsyFKfp6aa6DCwC7nZjSQ/bKR+lJEni17LmAk+rUnGqWR77uk5
CXn2BY2a1JfSEqADs4f6F00+8WWls+9vy6NMCtwGqfka7Su675Yg4zXRXYygFp4z
9XfBBJkDQLI=
=fF16
- -----END PGP SIGNATURE-----
- ----------------------------------------------------------------------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: python-reportlab security update
Advisory ID: RHSA-2020:0201-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:0201
Issue date: 2020-01-22
CVE Names: CVE-2019-17626
=====================================================================
1. Summary:
An update for python-reportlab is now available for Red Hat Enterprise
Linux 8.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AppStream (v. 8) - ppc64le, x86_64
3. Description:
Python-reportlab is a library used for generation of PDF documents.
Security Fix(es):
* python-reportlab: code injection in colors.py allows attacker to execute
code (CVE-2019-17626)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1769661 - CVE-2019-17626 python-reportlab: code injection in colors.py allows attacker to execute code
6. Package List:
Red Hat Enterprise Linux AppStream (v. 8):
Source:
python-reportlab-3.4.0-6.el8_1.2.src.rpm
ppc64le:
python-reportlab-debugsource-3.4.0-6.el8_1.2.ppc64le.rpm
python3-reportlab-3.4.0-6.el8_1.2.ppc64le.rpm
python3-reportlab-debuginfo-3.4.0-6.el8_1.2.ppc64le.rpm
x86_64:
python-reportlab-debugsource-3.4.0-6.el8_1.2.x86_64.rpm
python3-reportlab-3.4.0-6.el8_1.2.x86_64.rpm
python3-reportlab-debuginfo-3.4.0-6.el8_1.2.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2019-17626
https://access.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXihF79zjgjWX9erEAQj+Mg/+NooXNwsKUcwoi5kfVUOw7nhJ6x1OCBC6
vWaQbVYLXZMhq/BT5wptJI2qhJyi+TT08C118JqDWJ1UG/hGG4SHGSHFxxzsLNCh
I63RcsqK5ryRCskPQeoA516Vjsh85M8qd3A0pz2RirO9qEeAECjtIdzRjZILd2j8
zvqLEkuxOEflKUP2Rfy4nSQa7+cvGCSO2aCq4e79Yv9dPYV2bfMvmryW+4flmUDi
iPVfU4Fcpsv2cJTyWOjxzYgoLzDgcYq+83YJ4/fpbaCjaAGO9h5/myyQuIsN0lX8
IojWj7g4LP82laef8R/98yu98wjjwxfSgXn6fumVIkVYj/dnsVkz8kUbKRuLT9wL
0KSjig/zwTsEH7oohECAzRqPdyN9hROAiB3pd/MoNwHXgP7pVVfmPW464XTp3vib
yWhEbuXg+bZjf1JjGT8rDroHKo46TmHn0iD4xJm2yO6THpuYGolPSAf8OiJFwj89
MRIFN79O2EPTGjT6Uiku5D9yjewLHKT5WlJALzzEOza+6E3MmPah7r5B0n3Zxebo
uZK1H6GdXCuGWQ6i11yMWG+S2UY5E3TzQt5J2i8p/0SYq6OjP3i2r5aipJ6lWXrA
NL2EYc1VWpujxmM2+gxK6fro4zDA6gcWyZxvZ6Yn0mxehXSpcwk+NK+/ru1JjD/7
FXezgztAD+c=
=NY39
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXijjiWaOgq3Tt24GAQhdMxAApFiuWwCSpwBXVERbJBztVGBNpdqUdvNB
0VqNy6M9lq0YQ2rrgAli8hl9eDwlWU+gazcafqO83rwrk1x+dP7Ixd1p3RnzNQND
WSX91+N5FW7x9TgkSoFSAHDEbav+7Khj2QtYDstckhbub7wFB6wNPLkAG0IMXhVh
QGH1U21HsJP7HAeWI9halIgRU/VajWtWQffwQmvIW8GFh4Vi/w0D/aKLvYodi7LI
pWaWg2mmBewL5Vo9jKIZlX662V5VLF9O55m8sUVtcVePvs1V+k7OAnBioZosqeJF
VtgJX9HiMWku0TDrzFCruXHSURbOZU8j6tdzoo63Kh87m3Zq4bXqFix5GrgV0Spq
IbGwUwAWHLBKtxVIu0BNSljSEmp03gQskMGTxgDu0Cn2hXW5dyymsi6yT9MgN4Op
A49fK17z+4ya48C58K51Rs/LAznKLovwLyK0PJQ/mzRPiMBXaxghwI8w+o6HqeLw
OssSCp9QfjTRZA80sdvUInT8ZlggZ48o+SCYeItZx/EXwlVlqulFiSVN4OMImGhn
XrFvz/LN2CnpTr1rTM41h+5y41XFcCdghzO77ONsMGKJ9RL13HP7z/LKzEvNa0Y6
SlWZB9RxowzQQ90GbnMW23Nrw8SJsGjVfsggn3wWHBnF73TafSGUqvjgEibTJOQO
QlKEoEdKvOY=
=tBBH
-----END PGP SIGNATURE-----