Critical Vulnerability in RestrictedPython Package: Access to Protected Information
Summary
DEBIAN-CVE-2024-47532: RestrictedPython is a restricted execution environment for Python to run untrusted code. Affects restrictedpython versions < 8.0-1. Fixed in 8.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RestrictedPython is a specialized execution environment designed for Python, enabling the safe execution of untrusted code. It is widely used in scenarios where code needs to be executed with limited access to system resources, ensuring that potentially harmful operations are restricted. However, this package has been found to have vulnerabilities that could allow unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability arises from the ability of a user to indirectly access protected information through the AttributeError.obj and the string module. This flaw can lead to the exposure of sensitive data, compromising the integrity and security of applications relying on RestrictedPython for executing untrusted code. The issue is significant as it undermines the very purpose of using a restricted execution environment.
How To Fix
Minimum fixed version
8.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade restrictedpythonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, if the application does not require access to the string module, it can be removed from RestrictedPython.Utilities.utility_builtins. This can be achieved by modifying the code as follows: 'RestrictedPython.Utilities.utility_builtins.pop('string', None)'. This will prevent the string module from being available in the restricted execution environment.
Conclusion
The vulnerability in the RestrictedPython package poses a significant risk by allowing unauthorized access to sensitive information. Users are strongly advised to update to the patched version 8.0-1 to mitigate this risk. In the meantime, implementing the suggested workaround can provide temporary relief until the update is applied.
See every vulnerability recorded for restrictedpython →
FAQ
RestrictedPython is a Python library that allows for the execution of untrusted code in a controlled environment, limiting access to system resources.
The vulnerability allows users to access protected information indirectly, which could lead to data breaches or unauthorized access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing the provided workaround to mitigate the risk until the package can be updated.
Detailed information can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-47532.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for restrictedpython.
