PT-2024-32646 · Unknown+3 · Restrictedpython+3

Dronex7070 + 1 · Published 2024-09-30 · Updated 2025-03-18 · CVE-2024-47532

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions RestrictedPython versions prior to 7.3

Description A user can gain access to protected information indirectly via AttributeError.obj and the string module. This issue allows unauthorized access to potentially sensitive information.

Recommendations For versions prior to 7.3, as a temporary workaround, consider removing the string module from RestrictedPython.Utilities.utility builtins if the application does not require access to it, or otherwise do not make it available in the restricted execution environment. Update to version 7.3 to fully resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-47532

GHSA-5RFV-66G4-JR8H

PYSEC-2024-186

USN-7355-1

Affected Products

Debian

Linuxmint

Restrictedpython

Ubuntu

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47532.json · Exploit
• 🔥 https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-5rfv-66g4-jr8h · Exploit
• https://github.com/zopefoundation/RestrictedPython/commit/d701cc36cccac36b21fa200f1f2d1945a9a215e6 · Patch
• https://ubuntu.com/security/CVE-2023-41039 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-186 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-47532 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5rfv-66g4-jr8h · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-37271 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-22153 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-47532 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-47532 · Security Note
• https://ubuntu.com/security/CVE-2024-47532 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-47532 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-47532 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-47532 · Vendor Advisory