GHSA-5rfv-66g4-jr8h

Suggest an improvement
Source
https://github.com/advisories/GHSA-5rfv-66g4-jr8h
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-5rfv-66g4-jr8h/GHSA-5rfv-66g4-jr8h.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-5rfv-66g4-jr8h
Aliases
Published
2024-09-30T17:14:00Z
Modified
2024-09-30T20:25:20.262313Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
RestrictedPython information leakage via `AttributeError.obj` and the `string` module
Details

Impact

A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module.

Patches

The problem will be fixed in version 7.3.

Workarounds

If the application does not require access to the module string, it can remove it from RestrictedPython.Utilities.utility_builtins or otherwise do not make it available in the restricted execution environment.

References

Affected packages

PyPI / restrictedpython

Package

Name
restrictedpython
View open source insights on deps.dev
Purl
pkg:pypi/restrictedpython

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
7.3

Affected versions

3.*

3.4.2
3.4.3
3.5.0
3.5.1
3.5.2
3.6.0a1
3.6.0

4.*

4.0a1
4.0a2
4.0a3
4.0b1
4.0b2
4.0b3
4.0b4
4.0b5
4.0b6
4.0b7
4.0b8
4.0

5.*

5.0
5.1
5.2a1.dev0
5.2
5.3a1.dev0
5.3
5.4

6.*

6.0a1.dev0
6.0
6.1
6.2

7.*

7.0a1.dev0
7.0a1.dev1
7.0a2.dev0
7.0
7.1
7.2a1.dev0
7.2