CVE-2024-47532: falha de alta gravidade em zopefoundation RestrictedPython
RestrictedPython information leakage via `AttributeError.obj` and the `string` module
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.7%
RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module. The problem will be fixed in version 7.3. As a workaround, If the application does not require access to the module string, it can remove it from RestrictedPython.Utilities.utility_builtins or otherwise do not make it available in the restricted execution environment.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
zopefoundation · RestrictedPythonCVEs relacionadas — zopefoundation RestrictedPython
No mesmo produto, das mais perigosas para as menos.
CVE-2023-37271HIGHRestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escapeEPSS 0.8%CVE-2023-41039HIGHSandbox escape via various forms of "format" in RestrictedPythonEPSS 0.7%CVE-2026-76825HIGHRestrictedPython: Sandbox escape via string.Formatter field resolutionEPSS 0.6%CVE-2025-22153HIGHtry/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreterEPSS 0.4%CVE-2026-55830HIGHRestrictedPython guard hooks can be shadowed via positional-only argumentsEPSS 0.3%