{"id":"PYSEC-2024-186","details":"RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module. The problem will be fixed in version 7.3. As a workaround, If the application does not require access to the module string, it can remove it from RestrictedPython.Utilities.utility_builtins or otherwise do not make it available in the restricted execution environment.","aliases":["CVE-2024-47532","GHSA-5rfv-66g4-jr8h"],"modified":"2025-01-19T04:57:32.388938Z","published":"2024-09-30T16:15:09Z","references":[{"type":"EVIDENCE","url":"https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-5rfv-66g4-jr8h"},{"type":"FIX","url":"https://github.com/zopefoundation/RestrictedPython/commit/d701cc36cccac36b21fa200f1f2d1945a9a215e6"}],"affected":[{"package":{"name":"restrictedpython","ecosystem":"PyPI","purl":"pkg:pypi/restrictedpython"},"ranges":[{"type":"GIT","repo":"https://github.com/zopefoundation/restrictedpython","events":[{"introduced":"0"},{"fixed":"d701cc36cccac36b21fa200f1f2d1945a9a215e6"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3"}]}],"versions":["3.4.2","3.4.3","3.5.0","3.5.1","3.5.2","3.6.0","3.6.0a1","4.0","4.0a1","4.0a2","4.0a3","4.0b1","4.0b2","4.0b3","4.0b4","4.0b5","4.0b6","4.0b7","4.0b8","5.0","5.1","5.2","5.2a1.dev0","5.3","5.3a1.dev0","5.4","6.0","6.0a1.dev0","6.1","6.2","7.0","7.0a1.dev0","7.0a1.dev1","7.0a2.dev0","7.1","7.2","7.2a1.dev0"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/restrictedpython/PYSEC-2024-186.yaml"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}]}