GitHub Advisoryadvisory · PyPI

GHSA-5rfv-66g4-jr8h RestrictedPython information leakage via `AttributeError.obj` and the `string` module

HIGH Published 2024-09-30 Modified 2025-01-21 Official page ↗
Aliases
CVE-2024-47532
Ecosystem
PyPI
Packages
RestrictedPython
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2024-09-30

Affected packages

• PyPI RestrictedPython: < 7.3 → fixed in 7.3

Description

Impact A user can gain access to protected (and potentially sensible) information indirectly via `AttributeError.obj` and the `string` module. Patches The problem will be fixed in version 7.3. Workarounds If the application does not require access to the module `string`, it can remove it from `RestrictedPython.Utilities.utility_builtins` or otherwise do not make it available in the restricted execution environment.

Related

Alias · CVE (1)

  • CVE-2024-47532 RestrictedPython is a restricted execution environment for Python to run untrusted code. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References