Critical Information Disclosure Vulnerability in RestrictedPython Package
Summary
DEBIAN-CVE-2023-41039: RestrictedPython is a restricted execution environment for Python to run untrusted code. Affects restrictedpython versions < 6.2-1. Fixed in 6.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RestrictedPython is a specialized execution environment designed for Python that allows untrusted code to run safely. It restricts access to certain Python functionalities to prevent malicious actions. However, due to its reliance on Python's format functionality, it is susceptible to vulnerabilities that can lead to unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability arises from Python's 'format' functionality, which can be exploited by an attacker controlling the format string. This allows them to 'read' all objects accessible through recursive attribute lookup and subscription from objects they can access. The issue is present in all known versions of RestrictedPython, leading to critical information disclosure. The vulnerability has been addressed in commit '4134aedcff1', included in the 5.4 and 6.2 releases.
How To Fix
Minimum fixed version
6.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade restrictedpythonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. The best course of action is to upgrade to the patched version of RestrictedPython.
Conclusion
The vulnerability in the RestrictedPython package poses a significant risk of information disclosure due to its reliance on Python's format functionality. Users are strongly advised to upgrade to the latest patched version to mitigate this risk.
See every vulnerability recorded for restrictedpython →
FAQ
RestrictedPython is a restricted execution environment for Python that allows untrusted code to run safely.
This vulnerability allows an attacker to access sensitive information through unauthorized object access via format strings.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, the vulnerability has been patched in versions 5.4 and 6.2 of RestrictedPython.
There are no known workarounds for this vulnerability, so it is crucial to prioritize upgrading to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for restrictedpython.
