CVE-2023-41039

2 advisories.

PyPI/restrictedpython CVE-2023-41039: high 8.3

Sandbox escape via various forms of "format".

Action: Upgrade restrictedpython to 5.4 or later.

pip install restrictedpython==5.4

pip install restrictedpython==6.2

Affected

introduced	fixed	last affected
0	5.4	-
6.0	6.2	-

Fixed versions

5.4

6.2

Sources

osv: GHSA-xjw2-6jm9-rf67
https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-xjw2-6jm9-rf67
https://nvd.nist.gov/vuln/detail/CVE-2023-41039
https://github.com/zopefoundation/RestrictedPython/commit/4134aedcff17c977da7717693ed89ce56d54c120
https://github.com/zopefoundation/RestrictedPython

CVE-2023-41039 · published 2023-08-30T20:47:58Z · modified 2024-02-16T08:18:58.766349Z · JSON

PyPI/restrictedpython CVE-2023-41039: high 7.7

RestrictedPython is a restricted execution environment for Python to run untrusted code. Python's "format" functionality allows someone controlling the format string to "read" all objects accessible t

Action: Upgrade restrictedpython to 5.4 or later.

pip install restrictedpython==6.2

pip install restrictedpython==5.4

Affected

introduced	fixed	last affected
0	5.4	-
6.0	6.2	-

Fixed versions

6.2

5.4

Sources

osv: PYSEC-2023-159
https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-xjw2-6jm9-rf67
https://github.com/zopefoundation/RestrictedPython/commit/4134aedcff17c977da7717693ed89ce56d54c120

CVE-2023-41039 · published 2023-08-30T18:15:00Z · modified 2023-11-08T04:13:23.394567Z · JSON