Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS14ancyLTZqbTktcmY2N84AA1lM
Sandbox escape via various forms of "format".
Impact
Python's "format" functionality allows someone controlling the format string to "read" all objects accessible through recursive attribute lookup and subscription from objects he can access. This can lead to critical information disclosure.
With RestrictedPython
, the format functionality is available via the format
and format_map
methods of str
(and unicode
) (accessed either via the class or its instances) and via string.Formatter
.
All known versions of RestrictedPython
are vulnerable.
Patches
The issue will be fixed in 5.4 and 6.2.
Workarounds
There are no workarounds to fix the issue without upgrading.
References
- https://docs.python.org/3/library/stdtypes.html#str.format_map
- http://lucumr.pocoo.org/2016/12/29/careful-with-str-format/
- https://www.exploit-db.com/exploits/51580
For more information
If you have any questions or comments about this advisory:
- Open an issue in the RestrictedPython issue tracker
- Email us at [email protected]
Credits
Thanks for analysing and reporting the go to:
- Abhishek Govindarasu
- Ankush Menat
- Ward Theunisse
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14ancyLTZqbTktcmY2N84AA1lM
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 1 year ago
Updated: 12 months ago
CVSS Score: 8.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L
Identifiers: GHSA-xjw2-6jm9-rf67, CVE-2023-41039
References:
- https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-xjw2-6jm9-rf67
- https://nvd.nist.gov/vuln/detail/CVE-2023-41039
- https://github.com/zopefoundation/RestrictedPython/commit/4134aedcff17c977da7717693ed89ce56d54c120
- https://github.com/advisories/GHSA-xjw2-6jm9-rf67
Blast Radius: 23.7
Affected Packages
pypi:RestrictedPython
Dependent packages: 15Dependent repositories: 716
Downloads: 1,732,317 last month
Affected Version Ranges: >= 6.0, <= 6.1, <= 5.3
Fixed in: 6.2, 5.4
All affected versions: 3.4.2, 3.4.3, 3.5.0, 3.5.1, 3.5.2, 3.6.0
All unaffected versions: