CVE catalog

CVE-2024-47532

RestrictedPython vulnerabilities

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.72% · Oct 25, 2026

RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module. The problem will be fixed in version 7.3. As a workaround, If the application does not require access to the module string, it can remove it from RestrictedPython.Utilities.utility_builtins or otherwise do not make it available in the restricted execution environment.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrestrictedpythonsid8.4-1fixed
Debianrestrictedpythonforky8.4-1fixed
Debianrestrictedpythontrixie8.0-1fixed
Debianrestrictedpythonbookworm4.0~b3-3vulnerable
UbunturestrictedpythonnobleNot reportedvulnerable
Ubunturestrictedpythonnoble6.2-1ubuntu0.24.04.1~esm1fixed
Ubuntupython3-restrictedpythonnoble6.2-1ubuntu0.24.04.1~esm1fixed
Ubunturestrictedpythonpro4.0~b3-3vulnerable
Ubunturestrictedpythonpro6.2-1vulnerable
Ubunturestrictedpythonpro6.2-1ubuntu0.24.04.1~esm1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrestrictedpythonsourcesid8.0-1not yet assignedNot reported[1084057]
Debianrestrictedpythonsourceforky8.0-1not yet assignedNot reported[1084057]
Debianrestrictedpythonsourcetrixie8.0-1not yet assignedNot reported[1084057]
Debianrestrictedpythonsourcebookworm(unfixed)not yet assignedNot reported[1084057]
Ubunturestrictedpythondebnoble6.2-1ubuntu0.24.04.1~esm1Not reportedNot reportedNot reported
Ubuntupython3-restrictedpythondebnoble6.2-1ubuntu0.24.04.1~esm1Not reportedNot reportedNot reported
Ubunturestrictedpythondebpro6.2-1ubuntu0.24.04.1~esm1Not reportedUBUNTU-CVE-2024-47532Not reported

[Debian bug #1084057]

Notes

[bookworm] restrictedpython: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-restrictedpython]Affected

    Source package: [restrictedpython]

    Details (2)

    • 4.0~b3-3 · all · bookworm

      Affected

      usn · restrictedpython · debian · bookworm; usn · restrictedpython · debian · 12

    • 4.0~b3-3 · all · bookworm

      Affected

      usn · restrictedpython · debian · bookworm; usn · restrictedpython · debian · 12

[Debian 13 (Trixie)]

  • [python3-restrictedpython]Fixed

    Source package: [restrictedpython]

    Details (2)

    • 8.0-1 · all · trixie

      Fixed · Fixed: 8.0-1

      usn · restrictedpython · debian · 13

    • 8.0-1 · all · trixie

      Fixed · Fixed: 8.0-1

      usn · restrictedpython · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Ubuntu Security Notices (USN)]