p PatchFirst

CVE-2023-41039

CVE-2023-41039 · Sandbox escape via various forms of "format" in RestrictedPython

This page contains facts from public vulnerability sources. Check the original advisory before updating.

RestrictedPython is a restricted execution environment for Python to run untrusted code. Python's "format" functionality allows someone controlling the format string to "read" all objects accessible through recursive attribute lookup and subscription from objects he can access. This can lead to critical information disclosure. With `RestrictedPython`, the format functionality is available via the `format` and `format_map` methods of `str` (and `unicode`) (accessed either via the class or its instances) and via `string.Formatter`. All known versions of `RestrictedPython` are vulnerable. This issue has been addressed in commit `4134aedcff1` which has been included in the 5.4 and 6.2 releases. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 8.3 · High · EPSS 0.7% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • restrictedpython

    Versions
    • < 5.4: Affected
    • >= 6.0, < 6.1: Affected

    No fix published

  • restrictedpython Debian:12

    Versions
    • 4.0~b3-3
    • 6.2-1
    • 8.0-1
    • 8.1-1
    • 8.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • restrictedpython Debian:13

    Affected ranges
    • ECOSYSTEM: < 6.2-1

    Update to 6.2-1

  • restrictedpython Debian:14

    Affected ranges
    • ECOSYSTEM: < 6.2-1

    Update to 6.2-1

  • restrictedpython PyPI

    Versions
    • 3.4.2
    • 3.4.3
    • 3.5.0
    • 3.5.1
    • 3.5.2
    • 3.6.0
    • 3.6.0a1
    • 4.0
    • 4.0a1
    • 4.0a2
    • 4.0a3
    • 4.0b1
    • 4.0b2
    • 4.0b3
    • 4.0b4
    • 4.0b5
    • 4.0b6
    • 4.0b7
    • 4.0b8
    • 5.0
    • 5.1
    • 5.2
    • 5.2a1.dev0
    • 5.3
    • 5.3a1.dev0
    Affected ranges
    • ECOSYSTEM: < 5.4

    Update to 5.4

  • restrictedpython PyPI

    Versions
    • 6.0
    • 6.1
    Affected ranges
    • ECOSYSTEM: ≥ 6.0, < 6.2

    Update to 6.2

  • restrictedpython PyPI

    Versions
    • 3.4.2
    • 3.4.3
    • 3.5.0
    • 3.5.1
    • 3.5.2
    • 3.6.0
    • 3.6.0a1
    • 4.0
    • 4.0a1
    • 4.0a2
    • 4.0a3
    • 4.0b1
    • 4.0b2
    • 4.0b3
    • 4.0b4
    • 4.0b5
    • 4.0b6
    • 4.0b7
    • 4.0b8
    • 5.0
    • 5.1
    • 5.2
    • 5.2a1.dev0
    • 5.3
    • 5.3a1.dev0
    • 6.0
    • 6.1
    Affected ranges
    • GIT: < 4134aedcff17c977da7717693ed89ce56d54c120
    • ECOSYSTEM: ≥ 6.0, < 6.2 ∪ < 5.4

    Update to 6.2; Update to 5.4

  • restrictedpython Ubuntu:Pro:20.04:LTS

    Versions
    • 4.0~b3-2
    Affected ranges
    • ECOSYSTEM: < 4.0~b3-2ubuntu0.1~esm1

    Update to 4.0~b3-2ubuntu0.1~esm1

  • restrictedpython Ubuntu:Pro:22.04:LTS

    Versions
    • 4.0~b3-2
    • 4.0~b3-2ubuntu1
    • 4.0~b3-3
    Affected ranges
    • ECOSYSTEM: < 4.0~b3-3ubuntu0.1~esm1

    Update to 4.0~b3-3ubuntu0.1~esm1

Original sources

Check your server →