{"id":"GHSA-5rfv-66g4-jr8h","summary":"RestrictedPython information leakage via `AttributeError.obj` and the `string` module","details":"### Impact\nA user can gain access to protected (and potentially sensible) information indirectly via `AttributeError.obj` and the `string` module.\n\n### Patches\nThe problem will be fixed in version 7.3.\n\n\n### Workarounds\nIf the application does not require access to the module `string`, it can remove it from `RestrictedPython.Utilities.utility_builtins`  or otherwise do not make it available in the restricted execution environment.\n","aliases":["CVE-2024-47532","PYSEC-2024-186"],"modified":"2025-01-21T18:21:23.819184Z","published":"2024-09-30T17:14:00Z","database_specific":{"nvd_published_at":"2024-09-30T16:15:09Z","cwe_ids":["CWE-200"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2024-09-30T17:14:00Z"},"references":[{"type":"WEB","url":"https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-5rfv-66g4-jr8h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47532"},{"type":"WEB","url":"https://github.com/zopefoundation/RestrictedPython/commit/d701cc36cccac36b21fa200f1f2d1945a9a215e6"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/restrictedpython/PYSEC-2024-186.yaml"},{"type":"PACKAGE","url":"https://github.com/zopefoundation/RestrictedPython"}],"affected":[{"package":{"name":"restrictedpython","ecosystem":"PyPI","purl":"pkg:pypi/restrictedpython"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3"}]}],"versions":["3.4.2","3.4.3","3.5.0","3.5.1","3.5.2","3.6.0","3.6.0a1","4.0","4.0a1","4.0a2","4.0a3","4.0b1","4.0b2","4.0b3","4.0b4","4.0b5","4.0b6","4.0b7","4.0b8","5.0","5.1","5.2","5.2a1.dev0","5.3","5.3a1.dev0","5.4","6.0","6.0a1.dev0","6.1","6.2","7.0","7.0a1.dev0","7.0a1.dev1","7.0a2.dev0","7.1","7.2","7.2a1.dev0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-5rfv-66g4-jr8h/GHSA-5rfv-66g4-jr8h.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}