Most recent entries from all

bdu:2024-01492

certfr-2022-avi-767 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2022-avi-767

cnvd-2021-18390

EUVD-2026-180031

fkie_cve-2020-28463

All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src="http://127.0.0.1:5000" valign="top"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF

GHSA-mpvw-25mg-59vx — Server-side Request Forgery (SSRF) via img tags in reportlab

Affected: PyPI: reportlab

All versions of package reportlab at time of writing are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation)

Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject `<img src="http://127.0.0.1:5000" valign="top"/>` 4. Create a nc listener `nc -lp 5000` 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF

gsd-2020-28463

OESA-2022-1887 — python-reportlab security update

Affected: openEuler:20.03-LTS-SP1: python-reportlab, openEuler:20.03-LTS-SP3: python-reportlab, openEuler:22.03-LTS: python-reportlab

The ReportLab Toolkit. An Open Source Python library for generating PDFs and graphics. Security Fix(es): All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src="http://127.0.0.1:5000" valign="top"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF(CVE-2020-28463)

openSUSE-SU-2021:1147-1 — Security update for python-reportlab

Security update for python-reportlab

PYSEC-2021-146

Affected: PyPI: reportlab

SUSE-SU-2021:3209-1 — Security update for python-reportlab

Security update for python-reportlab

UBUNTU-CVE-2020-28463

Affected: Ubuntu:16.04:LTS: python-reportlab, Ubuntu:18.04:LTS: python-reportlab, Ubuntu:20.04:LTS: python-reportlab