GHSA-pq59-9fq7-m886 Zope AccessControl vulnerable to information disclosure through Python string `format` and `format_map` functions

• PyPI AccessControl: < 7.4 → fixed in 7.4

Impact Python's string `format` functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown `getattr` and `getitem`, not the policy restricted `AccessControl` variants `_getattr_` and `_getitem_`. This can lead to critical information disclosure. The `AccessControl` package already guards against direct access to the formatting functions on string instances, but these mitigations did not cover subclasses of `str`. Affected are all users who allow untrusted users to create AccessControl controlled Python code and execute it. Patches A fix was published with version 7.4. Workarounds There is no workaround.