CVE-2023-33733 Reportlab vulnerable to remote code execution
Attackers can execute arbitrary code by providing a crafted PDF file to applications using the Reportlab library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-33733?
CVE-2023-33733 is a high-severity code injection vulnerability in n/a, published on 5 Jun 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Reportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file.
Weakness: CWE-94
Which versions are affected by CVE-2023-33733?
3 open source packages ship an affected version, including reportlab. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
reportlab PyPI | All versions | 3.6.13 |
reportlab PyPI | All versions | 3.6.13 |
reportlab PyPI | All versions | 3.6.13 |
Linux distribution packages (5)
python-reportlab SUSE:Linux Enterprise Module for Package Hub 15 SP4 | All versions | 3.4.0-150000.3.9.1 |
python-reportlab SUSE:Linux Enterprise Module for Package Hub 15 SP5 | All versions | 3.4.0-150000.3.9.1 |
python-reportlab SUSE:Linux Enterprise Workstation Extension 12 SP5 | All versions | 2.7-3.13.1 |
python-reportlab openSUSE:Leap 15.4 | All versions | 3.4.0-150000.3.9.1 |
python-reportlab openSUSE:Leap 15.5 | All versions | 3.4.0-150000.3.9.1 |
Products include Reportlab Reportlab.
How do I fix CVE-2023-33733?
Upgrade reportlab to 3.6.13 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-33733 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-33733 exists.
Public exploit code: 5 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2023-33733, DLA-3917-1, DSA-5791-1, GHSA-9q9m-c65c-37pq, OESA-2023-1456, PYSEC-2026-1871 and 4 more.