CVE-2024-47532: RestrictedPython information leakage via `AttributeError.obj` and the `string` module
Impact A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module.
Patches The problem will be fixed in version 7.3.
Workarounds If the application does not require access to the module string, it can remove it from RestrictedPython.Utilities.utilitybuiltins or otherwise do not make it available in the restricted execution environment.
Other sources
RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module. The problem will be fixed in version 7.3. As a workaround, If the application does not require access to the module string, it can remove it from RestrictedPython.Utilities.utilitybuiltins or otherwise do not make it available in the restricted execution environment.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47532?
The CVE-2024-47532 vulnerability has been identified as having a significant impact as it allows unauthorized access to protected information.
How do I fix CVE-2024-47532?
You can fix CVE-2024-47532 by upgrading to version 7.3 of the RestrictedPython package.
What software is affected by CVE-2024-47532?
CVE-2024-47532 affects the RestrictedPython package prior to version 7.3.
Is there a workaround for CVE-2024-47532?
A temporary workaround for CVE-2024-47532 is to disable access to the string module if it is not required.
What causes CVE-2024-47532?
CVE-2024-47532 is caused by an AttributeError in the handling of the string module that exposes protected information.