GHSA-5rfv-66g4-jr8h
Suggest an improvement- Source
- https://github.com/advisories/GHSA-5rfv-66g4-jr8h
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-5rfv-66g4-jr8h/GHSA-5rfv-66g4-jr8h.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-5rfv-66g4-jr8h
- Aliases
- Published
- 2024-09-30T17:14:00Z
- Modified
- 2024-09-30T20:25:20.262313Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- RestrictedPython information leakage via `AttributeError.obj` and the `string` module
- Details
-
Impact
A user can gain access to protected (and potentially sensible) information indirectly via
AttributeError.objand thestringmodule.Patches
The problem will be fixed in version 7.3.
Workarounds
If the application does not require access to the module
string, it can remove it fromRestrictedPython.Utilities.utility_builtinsor otherwise do not make it available in the restricted execution environment. - References
Affected packages
PyPI / restrictedpython
Package
- Name
- restrictedpython
- View open source insights on deps.dev
- Purl
- pkg:pypi/restrictedpython