https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 21:34:25 +0000 https://cve.radiocsirt.org/vuln/cve-2023-41039 <p><strong>Affected:</strong> zopefoundation RestrictedPython</p> <p>RestrictedPython is a restricted execution environment for Python to run untrusted code. Python&#39;s &#34;format&#34; functionality allows someone controlling the format string to &#34;read&#34; all objects accessible through recursive attribute lookup and subscription from objects he can access. This can lead to critical information disclosure. With `RestrictedPython`, the format functionality is available via the `format` and `format_map` methods of `str` (and `unicode`) (accessed either via the class or its instances) and via `string.Formatter`. All known versions of `RestrictedPython` are vulnerable. This issue has been addressed in commit `4134aedcff1` which has been included in the 5.4 and 6.2 releases. Users are advised to upgrade. There are no known workarounds for this vulnerability.</p> <p><strong>Affected:</strong> zopefoundation RestrictedPython</p> <p>RestrictedPython is a restricted execution environment for Python to run untrusted code. Python&#39;s &#34;format&#34; functionality allows someone controlling the format string to &#34;read&#34; all objects accessible through recursive attribute lookup and subscription from objects he can access. This can lead to critical information disclosure. With `RestrictedPython`, the format functionality is available via the `format` and `format_map` methods of `str` (and `unicode`) (accessed either via the class or its instances) and via `string.Formatter`. All known versions of `RestrictedPython` are vulnerable. This issue has been addressed in commit `4134aedcff1` which has been included in the 5.4 and 6.2 releases. Users are advised to upgrade. There are no known workarounds for this vulnerability.</p> https://cve.radiocsirt.org/vuln/cve-2023-41039 https://cve.radiocsirt.org/vuln/ghsa-xjw2-6jm9-rf67 <p><strong>Affected:</strong> PyPI: RestrictedPython</p> <p>### Impact Python&#39;s &#34;format&#34; functionality allows someone controlling the format string to &#34;read&#34; all objects accessible through recursive attribute lookup and subscription from objects he can access. This can lead to critical information disclosure. With `RestrictedPython`, the format functionality is available via the `format` and `format_map` methods of `str` (and `unicode`) (accessed either via the class or its instances) and via `string.Formatter`. All known versions of `RestrictedPython` are vulnerable.</p> <p>### Patches The issue will be fixed in 5.4 and 6.2.</p> <p>### Workarounds There are no workarounds to fix the issue without upgrading.</p> <p>### References * https://docs.python.org/3/library/stdtypes.html#str.format_map * http://lucumr.pocoo.org/2016/12/29/careful-with-str-format/ * https://www.exploit-db.com/exploits/51580</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory:</p> <p>* Open an issue in the [RestrictedPython issue tracker](https://github.com/zopefoundation/RestrictedPython/issues) * Email us at [security@plone.org](mailto:security@plone.org)</p> <p>### Credits</p> <p>Thanks for analysing and reporting the go to:</p> <p>* Abhishek Govindarasu * Ankush Menat * Ward Theunisse</p> <p><strong>Affected:</strong> PyPI: RestrictedPython</p> <p>### Impact Python&#39;s &#34;format&#34; functionality allows someone controlling the format string to &#34;read&#34; all objects accessible through recursive attribute lookup and subscription from objects he can access. This can lead to critical information disclosure. With `RestrictedPython`, the format functionality is available via the `format` and `format_map` methods of `str` (and `unicode`) (accessed either via the class or its instances) and via `string.Formatter`. All known versions of `RestrictedPython` are vulnerable.</p> <p>### Patches The issue will be fixed in 5.4 and 6.2.</p> <p>### Workarounds There are no workarounds to fix the issue without upgrading.</p> <p>### References * https://docs.python.org/3/library/stdtypes.html#str.format_map * http://lucumr.pocoo.org/2016/12/29/careful-with-str-format/ * https://www.exploit-db.com/exploits/51580</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory:</p> <p>* Open an issue in the [RestrictedPython issue tracker](https://github.com/zopefoundation/RestrictedPython/issues) * Email us at [security@plone.org](mailto:security@plone.org)</p> <p>### Credits</p> <p>Thanks for analysing and reporting the go to:</p> <p>* Abhishek Govindarasu * Ankush Menat * Ward Theunisse</p> https://cve.radiocsirt.org/vuln/ghsa-xjw2-6jm9-rf67