Homepage
About Snyk

restrictedpython@3.4.2 vulnerabilities

RestrictedPython is a defined subset of the Python language which allows to provide a program input into a trusted environment.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the restrictedpython package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Uncaught Exception

RestrictedPython is a RestrictedPython is a defined subset of the Python language which allows to provide a program input into a trusted environment.

Affected versions of this package are vulnerable to Uncaught Exception in _AttributeDelegator, which allows attackers to expose string data associated with an AttributeError.obj.

How to fix Uncaught Exception?

Upgrade RestrictedPython to version 7.3 or higher.

[,7.3)
  • H
Access Control Bypass

RestrictedPython is a RestrictedPython is a defined subset of the Python language which allows to provide a program input into a trusted environment.

Affected versions of this package are vulnerable to Access Control Bypass via the format and format_map methods of str (and unicode) and string.Formatter. An attacker can lead to critical information disclosure by controlling the format string to "read" all objects accessible through recursive attribute lookup and subscription from objects the attacker can access.

How to fix Access Control Bypass?

Upgrade RestrictedPython to version 5.4, 6.2 or higher.

[,5.4) [6.0,6.2)
  • H
Arbitrary Code Execution

RestrictedPython is a RestrictedPython is a defined subset of the Python language which allows to provide a program input into a trusted environment.

Affected versions of this package are vulnerable to Arbitrary Code Execution via stack frame sandbox escape due to not checking access to stack frames and their attributes. Stack frames are accessible within at least generators and generator expressions, which are allowed inside RestrictedPython. An attacker with access to a RestrictedPython environment can write code that gets the current stack frame in a generator and then walk the stack all the way beyond the RestrictedPython invocation boundary, thus breaking out of the restricted scope and allowing the call of unrestricted Python code, therefore potentially allowing arbitrary code execution in the Python interpreter.

Note:

All RestrictedPython deployments that allow untrusted users to write Python code in the RestrictedPython environment are at risk. In terms of Zope and Plone, this would mean deployments where the administrator allows untrusted users to create and/or edit objects of type Script (Python), DTML Method, DTML Document or Zope Page Template. This is a non-default configuration and likely to be extremely rare.

How to fix Arbitrary Code Execution?

Upgrade RestrictedPython to version 5.3, 6.1 or higher.

[,5.3) [6.0a1.dev0,6.1)
Go back to all versions of this package