{"id":"CVE-2019-19450","aliases":["ALSA-2023:5790","DEBIAN-CVE-2019-19450","DLA-3590-1","EUVD-2023-2562","GHSA-pj98-2xf6-cff5","PYSEC-2026-522","RHSA-2023:5616","RHSA-2023:5786","RHSA-2023:5787","RHSA-2023:5788","RHSA-2023:5789","RHSA-2023:5790","SUSE-SU-2023:3972-1","SUSE-SU-2023:4048-1","UBUNTU-CVE-2019-19450"],"status":"published","title":"ReportLab vulnerable to remote code execution via paraparser","description":"paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '\u003cunichar code=\"' followed by arbitrary Python code, a similar issue to CVE-2019-17626.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.05978,"percentile":0.93352,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-91"],"published":"2023-09-20T00:00:00Z","modified":"2026-10-29T11:02:10Z","fixes":[{"ecosystem":"PyPI","package":"reportlab","fixed_in":["3.5.31"],"sources":["ghsa","osv"]},{"ecosystem":"AlmaLinux:8","package":"python3-reportlab","fixed_in":["3.4.0-8.el8_8.1.alma.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-reportlab","fixed_in":["3.5.31-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-reportlab","fixed_in":["3.5.31-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-reportlab","fixed_in":["3.5.31-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-reportlab","fixed_in":["0:2.5-11.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-reportlab-debuginfo","fixed_in":["0:2.5-11.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-reportlab-docs","fixed_in":["0:2.5-11.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-reportlab","fixed_in":["0:2.5-11.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-reportlab-debuginfo","fixed_in":["0:2.5-11.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-reportlab-docs","fixed_in":["0:2.5-11.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-reportlab","fixed_in":["0:2.5-11.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-reportlab-debuginfo","fixed_in":["0:2.5-11.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-reportlab-docs","fixed_in":["0:2.5-11.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"python-reportlab","fixed_in":["0:3.4.0-8.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"python-reportlab-debugsource","fixed_in":["0:3.4.0-8.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"python3-reportlab","fixed_in":["0:3.4.0-8.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"python3-reportlab-debuginfo","fixed_in":["0:3.4.0-8.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"python-reportlab","fixed_in":["0:3.4.0-8.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"python-reportlab-debugsource","fixed_in":["0:3.4.0-8.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"python3-reportlab","fixed_in":["0:3.4.0-8.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"python3-reportlab-debuginfo","fixed_in":["0:3.4.0-8.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"python-reportlab","fixed_in":["0:3.4.0-8.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"python-reportlab-debugsource","fixed_in":["0:3.4.0-8.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"python3-reportlab","fixed_in":["0:3.4.0-8.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"python3-reportlab-debuginfo","fixed_in":["0:3.4.0-8.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"python-reportlab","fixed_in":["0:3.4.0-8.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"python-reportlab-debugsource","fixed_in":["0:3.4.0-8.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"python3-reportlab","fixed_in":["0:3.4.0-8.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"python3-reportlab-debuginfo","fixed_in":["0:3.4.0-8.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"python-reportlab","fixed_in":["0:3.4.0-8.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"python-reportlab-debugsource","fixed_in":["0:3.4.0-8.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"python3-reportlab","fixed_in":["0:3.4.0-8.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"python3-reportlab-debuginfo","fixed_in":["0:3.4.0-8.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"python-reportlab","fixed_in":["0:3.4.0-8.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"python-reportlab-debugsource","fixed_in":["0:3.4.0-8.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"python3-reportlab","fixed_in":["0:3.4.0-8.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"python3-reportlab-debuginfo","fixed_in":["0:3.4.0-8.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"python-reportlab","fixed_in":["0:3.4.0-8.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"python-reportlab-debugsource","fixed_in":["0:3.4.0-8.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"python3-reportlab","fixed_in":["0:3.4.0-8.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"python3-reportlab-debuginfo","fixed_in":["0:3.4.0-8.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"python-reportlab","fixed_in":["0:3.4.0-6.el8_1.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"python-reportlab-debugsource","fixed_in":["0:3.4.0-6.el8_1.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"python3-reportlab","fixed_in":["0:3.4.0-6.el8_1.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"python3-reportlab-debuginfo","fixed_in":["0:3.4.0-6.el8_1.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-reportlab","fixed_in":["0:3.4.0-8.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-reportlab-debugsource","fixed_in":["0:3.4.0-8.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-reportlab","fixed_in":["0:3.4.0-8.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-reportlab-debuginfo","fixed_in":["0:3.4.0-8.el8_8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"python-reportlab","fixed_in":["3.4.0-150000.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"python-reportlab","fixed_in":["3.4.0-150000.3.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"python-reportlab","fixed_in":["3.4.0-150000.3.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"python-reportlab","fixed_in":["3.4.0-150000.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"python-reportlab","fixed_in":["2.7-3.16.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.31"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-8.el8_8.1.alma.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.31-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.31-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.31-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"python-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.13-1+deb10u2"}]}],"versions":["3.5.13-1","3.5.13-1+deb10u1"],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.31"}]}],"versions":["2.0","2.3","2.4","2.5","2.6","2.7","3.0","3.1.44","3.1.8","3.2.0","3.3.0","3.4.0","3.5.0","3.5.1","3.5.10","3.5.11","3.5.12","3.5.13","3.5.16","3.5.17","3.5.18","3.5.19","3.5.2","3.5.20","3.5.21","3.5.23","3.5.26","3.5.28","3.5.4","3.5.5","3.5.6","3.5.8","3.5.9"]},{"source":"osv","ecosystem":"PyPI","package":"reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.31"}]}],"versions":["2.0","2.3","2.4","2.5","2.6","2.7","3.0","3.1.44","3.1.8","3.2.0","3.3.0","3.4.0","3.5.0","3.5.1","3.5.10","3.5.11","3.5.12","3.5.13","3.5.16","3.5.17","3.5.18","3.5.19","3.5.2","3.5.20","3.5.21","3.5.23","3.5.26","3.5.28","3.5.4","3.5.5","3.5.6","3.5.8","3.5.9"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5-11.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-reportlab-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5-11.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-reportlab-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5-11.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5-11.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-reportlab-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5-11.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-reportlab-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5-11.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5-11.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-reportlab-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5-11.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-reportlab-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5-11.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"python-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"python-reportlab-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"python3-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"python3-reportlab-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"python-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"python-reportlab-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"python3-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"python3-reportlab-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"python-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"python-reportlab-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"python3-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"python3-reportlab-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"python-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"python-reportlab-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"python3-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"python3-reportlab-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"python-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"python-reportlab-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"python3-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"python3-reportlab-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"python-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"python-reportlab-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"python3-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"python3-reportlab-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"python-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"python-reportlab-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"python3-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"python3-reportlab-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"python-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-6.el8_1.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"python-reportlab-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-6.el8_1.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"python3-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-6.el8_1.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"python3-reportlab-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-6.el8_1.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-reportlab-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-reportlab-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-8.el8_8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"python-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-150000.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"python-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-150000.3.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"python-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-150000.3.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-150000.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"python-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7-3.16.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.0-1build1","3.2.0-1build2","3.3.0-1","3.3.0-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-reportlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.0-3build1","3.4.0-3ubuntu0.1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"reportlab","product":"reportlab"}],"references":[{"url":"https://github.com/MrBitBucket/reportlab-mirror/blob/master/CHANGES.md","tags":["x_transferred","Release Notes","advisory","web","report"]},{"url":"https://pastebin.com/5MicRrr4","tags":["x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00037.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHMCB2GJQKFMGVO5RWHN222NQL5XYPHZ/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HADPTB3SBU7IVRMDK7OL6WSQRU5AFWDZ/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHMCB2GJQKFMGVO5RWHN222NQL5XYPHZ/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HADPTB3SBU7IVRMDK7OL6WSQRU5AFWDZ/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19450","tags":["advisory"]},{"url":"https://github.com/MrBitBucket/reportlab-mirror/blob/master/CHANGES.md#release-353115102019","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHMCB2GJQKFMGVO5RWHN222NQL5XYPHZ","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HADPTB3SBU7IVRMDK7OL6WSQRU5AFWDZ","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pj98-2xf6-cff5","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5790","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-19450","tags":["report"]},{"url":"https://bugzilla.redhat.com/2239920","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-5790.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-19450","tags":["advisory"]},{"url":"https://hg.reportlab.com/hg-public/reportlab","tags":["package"]},{"url":"https://pypi.org/project/reportlab","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5616","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2239920","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5616.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-19450","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5786","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5786.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5787","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5787.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5788","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5788.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5789","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5789.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5790.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233972-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1215560","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19450","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234048-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-19450","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-19450","description":"paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '\u003cunichar code=\"' followed by arbitrary Python code, a similar issue to CVE-2019-17626.","status":"published","published":"2023-09-20T00:00:00Z","modified":"2024-08-05T02:16:47.205Z","updated_at":"2026-11-02T14:20:20.74896Z"}],"euvd":[{"id":"EUVD-2023-2562","description":"paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '\u003cunichar code=\"' followed by arbitrary Python code, a similar issue to CVE-2019-17626.","status":"published","published":"2023-09-20T00:00:00Z","modified":"2024-08-05T02:16:47Z","updated_at":"2026-11-03T02:40:25.391321Z"}],"ghsa":[{"id":"GHSA-pj98-2xf6-cff5","title":"ReportLab vulnerable to remote code execution via paraparser","description":"paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '\u003cunichar code=\"' followed by arbitrary Python code, a similar issue to CVE-2019-17626.","status":"published","published":"2023-09-20T15:30:51Z","modified":"2024-04-28T06:31:25Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-91"],"updated_at":"2026-11-02T14:37:47.338362Z"}],"nvd":[{"id":"CVE-2019-19450","description":"paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '\u003cunichar code=\"' followed by arbitrary Python code, a similar issue to CVE-2019-17626.","status":"published","published":"2023-09-20T14:15:12.31Z","modified":"2026-06-17T02:26:40.547Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-91"],"updated_at":"2026-11-02T14:05:49.099942Z"}],"osv":[{"id":"CVE-2019-19450","description":"paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '\u003cunichar code=\"' followed by arbitrary Python code, a similar issue to CVE-2019-17626.","status":"published","published":"2023-09-20T14:15:12.31Z","modified":"2026-06-29T12:26:48.362635242Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:12.010761Z"},{"id":"DEBIAN-CVE-2019-19450","description":"paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '\u003cunichar code=\"' followed by arbitrary Python code, a similar issue to CVE-2019-17626.","status":"published","published":"2023-09-20T14:15:12.31Z","modified":"2026-09-21T07:03:16.585275971Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"GHSA-pj98-2xf6-cff5","title":"ReportLab vulnerable to remote code execution via paraparser","description":"paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '\u003cunichar code=\"' followed by arbitrary Python code, a similar issue to CVE-2019-17626.","status":"published","published":"2023-09-20T15:30:51Z","modified":"2026-06-29T12:26:48.362635242Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-91"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"PYSEC-2026-522","title":"ReportLab vulnerable to remote code execution via paraparser","description":"paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '\u003cunichar code=\"' followed by arbitrary Python code, a similar issue to CVE-2019-17626.","status":"published","published":"2026-06-29T11:50:43.99509Z","modified":"2026-07-01T20:23:04.001605Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:57.671918Z"},{"id":"RHSA-2023:5616","title":"Red Hat Security Advisory: python-reportlab security update","status":"published","published":"2024-09-16T13:51:48Z","modified":"2026-06-26T11:07:27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:5786","title":"Red Hat Security Advisory: python-reportlab security update","status":"published","published":"2024-09-16T13:52:34Z","modified":"2026-03-18T11:33:21.200453Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:5787","title":"Red Hat Security Advisory: python-reportlab security update","status":"published","published":"2024-09-16T13:52:25Z","modified":"2026-03-18T11:33:19.18788Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:5788","title":"Red Hat Security Advisory: python-reportlab security update","status":"published","published":"2024-09-16T13:52:16Z","modified":"2026-03-18T11:33:19.400274Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:5789","title":"Red Hat Security Advisory: python-reportlab security update","status":"published","published":"2024-09-16T13:52:08Z","modified":"2026-03-18T11:33:20.177385Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:5790","title":"Red Hat Security Advisory: python-reportlab security update","status":"published","published":"2024-09-16T13:51:58Z","modified":"2026-03-18T11:33:20.424502Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"UBUNTU-CVE-2019-19450","description":"paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '\u003cunichar code=\"' followed by arbitrary Python code, a similar issue to CVE-2019-17626.","status":"published","published":"2023-09-20T14:15:00Z","modified":"2025-10-24T04:48:03Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"ALSA-2023:5790","title":"Important: python-reportlab security update","description":"Python-reportlab is a library used for generation of PDF documents.\n\nSecurity Fix(es):\n\n* python-reportlab: code injection in paraparser.py allows code execution (CVE-2019-19450)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-10-17T00:00:00Z","modified":"2026-10-29T11:02:10.793955479Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"DLA-3590-1","title":"python-reportlab - security update","status":"published","published":"2023-09-29T00:00:00Z","modified":"2026-03-09T01:17:53.228721Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"SUSE-SU-2023:3972-1","title":"Security update for python-reportlab","description":"This update for python-reportlab fixes the following issues:\n\n- CVE-2019-19450: Fixed an issue which allowed remote code execution via start_unichar in paraparser.py evaluating untrusted user input. (bsc#1215560)\n","status":"published","published":"2023-10-04T14:11:14Z","modified":"2026-02-04T04:09:10.944791Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:4048-1","title":"Security update for python-reportlab","description":"This update for python-reportlab fixes the following issues:\n\n- CVE-2019-19450: Fixed an issue which allowed remote code execution via start_unichar in paraparser.py evaluating untrusted user input. (bsc#1215560)\n","status":"published","published":"2023-10-11T09:28:40Z","modified":"2026-02-04T02:31:26.595901Z","updated_at":"2026-11-02T15:53:53.440387Z"}]}}