{
  "id": "openEuler-SA-2022-1887",
  "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2022-1887",
  "title": "An update for python-reportlab is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS",
  "severity": "Medium",
  "description": "The ReportLab Toolkit. An Open Source Python library for generating PDFs and graphics.\r\n\r\nSecurity Fix(es):\r\n\r\nAll versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src=\"http://127.0.0.1:5000\" valign=\"top\"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF(CVE-2020-28463)",
  "cves": [
    {
      "id": "CVE-2020-28463",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28463",
      "severity": "Medium"
    }
  ]
}