Access Control Bypass Affecting restrictedpython package, versions [,5.4) [6.0,6.2)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-RESTRICTEDPYTHON-5876648
- published 31 Aug 2023
- disclosed 30 Aug 2023
- credit Abhishek Govindarasu, Ankush Menat, Ward Theunisse
Introduced: 30 Aug 2023
CVE-2023-41039 Open this link in a new tabHow to fix?
Upgrade RestrictedPython to version 5.4, 6.2 or higher.
Overview
RestrictedPython is a RestrictedPython is a defined subset of the Python language which allows to provide a program input into a trusted environment.
Affected versions of this package are vulnerable to Access Control Bypass via the format and format_map methods of str (and unicode) and string.Formatter. An attacker can lead to critical information disclosure by controlling the format string to "read" all objects accessible through recursive attribute lookup and subscription from objects the attacker can access.