What is GHSA-5rfv-66g4-jr8h?

GHSA-5rfv-66g4-jr8h is a security advisory published by GitHub Security Advisories with High severity. RestrictedPython information leakage via `AttributeError.obj` and the `string` module

Which CVE IDs does GHSA-5rfv-66g4-jr8h cover?

GHSA-5rfv-66g4-jr8h covers the following CVE IDs: CVE-2024-47532. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5rfv-66g4-jr8h?

GHSA-5rfv-66g4-jr8h has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-5rfv-66g4-jr8h?

GHSA-5rfv-66g4-jr8h affects 1 product, including: pip/RestrictedPython:\u003c 7.3.

GHSA-5rfv-66g4-jr8hHighCVSS 7.5

RestrictedPython information leakage via `AttributeError.obj` and the `string` module

Vendor

GitHub Security Advisories

Published

September 30, 2024

Last Modified

January 21, 2025

🔗 CVE IDs covered (1)

CVE-2024-47532 →

📋 Description

Impact

A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module.

Patches

The problem will be fixed in version 7.3.

Workarounds

If the application does not require access to the module string, it can remove it from RestrictedPython.Utilities.utility_builtins or otherwise do not make it available in the restricted execution environment.

🎯 Affected products1

pip/RestrictedPython:< 7.3

🔗 References (5)

https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-5rfv-66g4-jr8h
https://github.com/zopefoundation/RestrictedPython/commit/d701cc36cccac36b21fa200f1f2d1945a9a215e6
https://nvd.nist.gov/vuln/detail/CVE-2024-47532
https://github.com/pypa/advisory-database/tree/main/vulns/restrictedpython/PYSEC-2024-186.yaml
https://github.com/advisories/GHSA-5rfv-66g4-jr8h