[IT-SecNots] [SECURITY] [DSA 4663-1] python-reportlab security update

[Salvatore Bonaccorso <carnil AT debian.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4663-1                   security AT debian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
April 25, 2020                        https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : python-reportlab
CVE ID         : CVE-2019-17626
Debian Bug     : 942763

It was discovered that python-reportlab, a Python library to create PDF
documents, is prone to a code injection vulnerability while parsing a
color attribute. An attacker can take advantage of this flaw to execute
arbitrary code if a specially crafted document is processed.

For the oldstable distribution (stretch), this problem has been fixed
in version 3.3.0-2+deb9u1.

For the stable distribution (buster), this problem has been fixed in
version 3.5.13-1+deb10u1.

We recommend that you upgrade your python-reportlab packages.

For the detailed security status of python-reportlab please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/python-reportlab

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce AT lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAl6kBzhfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0Sv+Q/+P46iKMP9gXnrAxALo+e91Ys8NWGuFsaTX5hZOxWtYOkCgwQoNDJbiaCJ
WvZkddkiD6bkdLX/9BQVRn9iVfqWp5Cies56wRm0Do15JFTmuNYgeECRdJsSDXbu
Qiq8AkIK37qEAj1CBTL2uymsBhI+L1MZu1XcO3rsJNZKL05ksaicmKp0ia9LuHdP
ULNhcVkz46bFCOdGQB7I3EPtVPFWV95zfHNrT9Ar+sra/9CGWVtp7Y+lZwUU5CTe
HcvExRIcus34Yf9/DGm0Gx+ebCqG8QMKK28Sv3DAdvy106EeG1jxpR6TXTra1vAw
gFIUAStknWpYloJp52IF7i4Q6BFGn22owBcFzGtSVyIbXmIOtiR+pdcPSXhIN8WQ
FA5ozConxHk6ITaNfyOCpv0+ds2LSE4wwnNtCk1sc/lP+k+ocTS4bUwBHjdazGPf
z+15qQwaZEKMZH5IyXWzB8phOoBbAG2ZuCpNC7dx+jcrUdidvqsDdkqe5SNKpO6z
y17RUwJ8/1Gtc9oimlKA7JxgQKlF5NTVpp8EhuK2+4iI4DDMnu4GKtOnkLPjpZ/n
0UzteEsgeroBHyzZdp+GzbQUljGXn3/t+PVSkZX+TBdOn8pLl+oTd/ZQI0y+1Ryl
k75pPORqDPrc/dnn/XSvBdyJlqBPxgz48y8aMVQSVThNEKjJbgM=
=qjp/
-----END PGP SIGNATURE-----