PT-2025-4387 · Python+2 · Restrictedpython+3

Nico-Posada · Published 2025-01-23 · Updated 2025-03-18 · CVE-2025-22153

Positive Technologies (AI Summary)

CVSS v3.1

7.9

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions RestrictedPython versions 6.0 through 7.x CPython interpreter versions 3.11 through 3.13.1

Description The issue is caused by a type confusion bug in the CPython interpreter when using try/except*. This bug allows RestrictedPython to be bypassed, potentially compromising the security of the trusted environment. The problem is resolved in version 8.0 of RestrictedPython by removing support for try/except* clauses. There are no known workarounds available.

Recommendations For RestrictedPython versions 6.0 through 7.x, update to version 8.0 to resolve the issue. For CPython interpreter versions 3.11 through 3.13.1, consider upgrading to a version where the type confusion bug is fixed, or avoid using try/except* clauses until a patch is available. As a temporary workaround, consider disabling the use of try/except* clauses in RestrictedPython until a patch is available.

Exploit

Fix

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

CVE-2025-22153

GHSA-GMJ9-H825-CHQ2

USN-7355-1

Affected Products

Cpython

Linuxmint

Restrictedpython

Ubuntu

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22153.json · Exploit
• https://ubuntu.com/security/CVE-2023-41039 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-22153 · Security Note
• https://ubuntu.com/security/CVE-2023-37271 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-22153 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-22153 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-22153 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-22153 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-47532 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-22153 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-22153 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7355-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gmj9-h825-chq2 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7355-1 · Vendor Advisory
• https://github.com/zopefoundation/RestrictedPython/commit/48a92c5bb617a647cffd0dadd4d5cfe626bcdb2f · Note