What is GHSA-gmj9-h825-chq2?

GHSA-gmj9-h825-chq2 is a security advisory published by GitHub Security Advisories with High severity. try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter

Which CVE IDs does GHSA-gmj9-h825-chq2 cover?

GHSA-gmj9-h825-chq2 covers the following CVE IDs: CVE-2025-22153. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gmj9-h825-chq2?

GHSA-gmj9-h825-chq2 has a CVSS v3 base score of 7.9, published by GitHub Security Advisories.

Which products are affected by GHSA-gmj9-h825-chq2?

GHSA-gmj9-h825-chq2 affects 1 product, including: pip/RestrictedPython:\u003e= 6.0, \u003c 8.0.

GHSA-gmj9-h825-chq2HighCVSS 7.9

try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter

Vendor

GitHub Security Advisories

Published

January 23, 2025

Last Modified

January 23, 2025

🔗 CVE IDs covered (1)

CVE-2025-22153 →

📋 Description

Impact

Via a type confusion bug in the CPython interpreter when using try/except* RestrictedPython could be bypassed.

We believe this should be fixed upstream in Python itself until that we remove support for try/except* from RestrictedPython. (It has been fixed for some Python versions.)

Patches

Patched in version 8.0 by removing support for try/except* clauses

Workarounds

There is no workaround.

References

none

🎯 Affected products1

pip/RestrictedPython:>= 6.0, < 8.0

🔗 References (4)

https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-gmj9-h825-chq2
https://github.com/zopefoundation/RestrictedPython/commit/48a92c5bb617a647cffd0dadd4d5cfe626bcdb2f
https://nvd.nist.gov/vuln/detail/CVE-2025-22153
https://github.com/advisories/GHSA-gmj9-h825-chq2