zopefoundation/restrictedpython · Security
RestrictedPython information leakage via `AttributeError.obj` and the `string` module
- GHSA ID
- GHSA-5rfv-66g4-jr8h
- CVE ID
- CVE-2024-47532
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v4
- 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Description
Impact
A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module.
Patches
The problem will be fixed in version 7.3.
Workarounds
If the application does not require access to the module string, it can remove it from RestrictedPython.Utilities.utility_builtins or otherwise do not make it available in the restricted execution environment.
CWEs
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
References
- https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-5rfv-66g4-jr8h ↗
- https://github.com/zopefoundation/RestrictedPython/commit/d701cc36cccac36b21fa200f1f2d1945a9a215e6 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2024-47532 ↗
- https://github.com/pypa/advisory-database/tree/main/vulns/restrictedpython/PYSEC-2024-186.yaml ↗
- https://github.com/advisories/GHSA-5rfv-66g4-jr8h ↗