Fluid Attacks Database

Description

Reportlab vulnerable to remote code execution Reportlab up to and including v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
pypi	reportlab	>=0 <3.6.13	3.6.13
debian 12	python-reportlab	=3.6.12-1 \|\| >=0 <3.6.12-1+deb12u1	3.6.12-1+deb12u1
debian 13	python-reportlab	>=0 <3.6.13-1	3.6.13-1
debian 14	python-reportlab	>=0 <3.6.13-1	3.6.13-1

Aliases

1. CVE-2023-337332. NVD-2023-337333. OSV-2023-337334. OSV-DEBIAN-2023-337335. GCVE-2023-337336. lists.debian.org7. SECURITY-TRACKER-CVE-2023-33733

References

1. https://github.com/c53elyas/CVE-2023-337332. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36WOY22ECJCPOXHVTNCHEWOQLL7JSWP43. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ALE727IRACYBTTOFIFG57RS4OA2SHIJ4. https://lists.fedoraproject.org/archives/list/[email protected]/message/36WOY22ECJCPOXHVTNCHEWOQLL7JSWP45. https://lists.fedoraproject.org/archives/list/[email protected]/message/6ALE727IRACYBTTOFIFG57RS4OA2SHIJ

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.