PT-2023-25874 · Unknown+3 · Restrictedpython+3

Despawningbone + 1 · Published 2023-07-10 · Updated 2025-03-24 · CVE-2023-37271

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RestrictedPython versions prior to 5.3 RestrictedPython versions prior to 6.1

Description The issue allows an attacker with access to a RestrictedPython environment to write code that gets the current stack frame in a generator and then walk the stack all the way beyond the RestrictedPython invocation boundary, thus breaking out of the restricted sandbox and potentially allowing arbitrary code execution in the Python interpreter. All RestrictedPython deployments that allow untrusted users to write Python code in the RestrictedPython environment are at risk, particularly those where administrators allow untrusted users to create or edit certain object types.

Recommendations For versions prior to 5.3, update to version 5.3 or later. For versions prior to 6.1, update to version 6.1 or later. If you cannot upgrade to the latest release, ensure the RestrictedPython environment is only available for trusted users.

Exploit

Fix

Weakness Enumeration

CWE-913

Related Identifiers

CVE-2023-37271

GHSA-WQC8-X2PR-7JQH

PYSEC-2023-118

USN-7355-1

Affected Products

Debian

Linuxmint

Restrictedpython

Ubuntu

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37271.json · Exploit
• https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-wqc8-x2pr-7jqh · Vendor Advisory
• https://github.com/zopefoundation/RestrictedPython/commit/c8eca66ae49081f0016d2e1f094c3d72095ef531 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-37271 · Security Note
• https://ubuntu.com/security/CVE-2024-47532 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-37271 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-37271 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-41039 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7355-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-37271 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wqc8-x2pr-7jqh · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-22153 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7355-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-37271 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-37271 · Vendor Advisory