En resumen
- CVE-2024-47532 es una vulnerabilidad MEDIO (CVSS 6.5) que afecta a restrictedpython, restrictedpython (zope).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.72%, mayor que el 53.8% de las vulnerabilidades.
- Solución: actualizar a 7.3 o posterior.
Description
Impact
A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module.
Patches
The problem will be fixed in version 7.3.
Workarounds
If the application does not require access to the module string, it can remove it from RestrictedPython.Utilities.utility_builtins or otherwise do not make it available in the restricted execution environment.
NVD description
RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module. The problem will be fixed in version 7.3. As a workaround, If the application does not require access to the module string, it can remove it from RestrictedPython.Utilities.utility_builtins or otherwise do not make it available in the restricted execution environment.
Más vulnerabilidades de restrictedpython
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free