{"id":"GHSA-xjw2-6jm9-rf67","summary":"Sandbox escape via various forms of \"format\".","details":"### Impact\nPython's \"format\" functionality allows someone controlling the format string to \"read\" all objects accessible through recursive attribute lookup and subscription from objects he can access. This can lead to critical information disclosure.\nWith `RestrictedPython`, the format functionality is available via the `format` and `format_map` methods of `str` (and `unicode`) (accessed either via the class or its instances) and via `string.Formatter`.\nAll known versions of `RestrictedPython` are vulnerable. \n\n### Patches\nThe issue will be fixed in 5.4 and 6.2.\n\n### Workarounds\nThere are no workarounds to fix the issue without upgrading.\n\n### References\n* https://docs.python.org/3/library/stdtypes.html#str.format_map\n* http://lucumr.pocoo.org/2016/12/29/careful-with-str-format/\n* https://www.exploit-db.com/exploits/51580\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in the [RestrictedPython issue tracker](https://github.com/zopefoundation/RestrictedPython/issues)\n* Email us at [security@plone.org](mailto:security@plone.org)\n\n### Credits\n\nThanks for analysing and reporting the go to:\n\n* Abhishek Govindarasu\n* Ankush Menat\n* Ward Theunisse\n\n","aliases":["CVE-2023-41039","PYSEC-2023-159"],"modified":"2024-02-16T08:18:58.766349Z","published":"2023-08-30T20:47:58Z","database_specific":{"cwe_ids":["CWE-74"],"github_reviewed_at":"2023-08-30T20:47:58Z","github_reviewed":true,"nvd_published_at":"2023-08-30T18:15:09Z","severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-xjw2-6jm9-rf67"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41039"},{"type":"WEB","url":"https://github.com/zopefoundation/RestrictedPython/commit/4134aedcff17c977da7717693ed89ce56d54c120"},{"type":"PACKAGE","url":"https://github.com/zopefoundation/RestrictedPython"}],"affected":[{"package":{"name":"restrictedpython","ecosystem":"PyPI","purl":"pkg:pypi/restrictedpython"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4"}]}],"versions":["3.4.2","3.4.3","3.5.0","3.5.1","3.5.2","3.6.0","3.6.0a1","4.0","4.0a1","4.0a2","4.0a3","4.0b1","4.0b2","4.0b3","4.0b4","4.0b5","4.0b6","4.0b7","4.0b8","5.0","5.1","5.2","5.2a1.dev0","5.3","5.3a1.dev0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-xjw2-6jm9-rf67/GHSA-xjw2-6jm9-rf67.json","last_known_affected_version_range":"\u003c= 5.3"}},{"package":{"name":"restrictedpython","ecosystem":"PyPI","purl":"pkg:pypi/restrictedpython"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0"},{"fixed":"6.2"}]}],"versions":["6.0","6.1"],"database_specific":{"last_known_affected_version_range":"\u003c= 6.1","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-xjw2-6jm9-rf67/GHSA-xjw2-6jm9-rf67.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L"}]}