Improper Control of Dynamically-Managed Code Resources Affecting asteval package, versions [,1.0.9)

asteval is a Safe, minimalistic evaluator of python expression using ast module

Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources through the Interpreter process when evaluating attacker-controlled expressions with numpy enabled. An attacker can read and write arbitrary process memory by leveraging accessible ctypes type metaclass methods via numpy's ndarray.ctypes wrapper, bypassing attribute filters and exploiting unfiltered attribute assignment. This can lead to disclosure of sensitive data, memory corruption, arbitrary code execution, or process crash. This is only exploitable if untrusted input is evaluated with numpy installed and enabled, and import is disabled by default.

This vulnerability can be mitigated by constructing the interpreter with use_numpy set to False.

• GitHub Advisory
• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release