UBUNTU-CVE-2026-102734

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-102734
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102734.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-102734
Upstream
Published
2026-10-15T00:00:00Z
Modified
2026-10-17T12:59:45Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits from_address memory access. safe_getattr blocks the ctypes module but not reachable ctypes type objects, while attribute assignments use unfiltered setattr instead of safe_setattr. An attacker-controlled expression can derive an address with id, read memory through from_address, and write through an attribute assignment. The expression can read or corrupt arbitrary process memory, escape the intended sandbox, execute code, disclose secrets, or crash the host process. This issue is fixed in version 1.0.9.

References

Affected packages

Ubuntu:20.04:LTS / python-asteval

Package

Name
python-asteval
Purl
pkg:deb/ubuntu/python-asteval?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.9.12-1
0.9.12-2
0.9.17-1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "python3-asteval",
            "binary_version":  "0.9.17-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102734.json"

Ubuntu:22.04:LTS / python-asteval

Package

Name
python-asteval
Purl
pkg:deb/ubuntu/python-asteval?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.9.19-2
0.9.25-2

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "python3-asteval",
            "binary_version":  "0.9.25-2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102734.json"

Ubuntu:24.04:LTS / python-asteval

Package

Name
python-asteval
Purl
pkg:deb/ubuntu/python-asteval?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.9.30-1
0.9.31-1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "python3-asteval",
            "binary_version":  "0.9.31-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102734.json"

Ubuntu:26.10 / python-asteval

Package

Name
python-asteval
Purl
pkg:deb/ubuntu/python-asteval?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.0.6-2

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "python3-asteval",
            "binary_version":  "1.0.6-2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102734.json"

Ubuntu:26.04:LTS / python-asteval

Package

Name
python-asteval
Purl
pkg:deb/ubuntu/python-asteval?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.0.6-2

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "python3-asteval",
            "binary_version":  "1.0.6-2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102734.json"