Ubuntu alert USN-7355-1 (restrictedpython)

From:
             
 
Bruce Cable <bruce.cable@canonical.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-7355-1] RestrictedPython vulnerabilities
Date:
             
 
Wed, 19 Mar 2025 11:50:12 +1100
Message-ID:
             
 
<013677b1-69af-4531-9846-7b2928c350d6@canonical.com>
==========================================================================
Ubuntu Security Notice USN-7355-1
March 18, 2025

restrictedpython vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in RestrictedPython.

Software Description:
- restrictedpython: Restricted execution environment for Python 3

Details:

Nakul Choudhary and Robert Xiao discovered that RestrictedPython did not
properly sanitize certain inputs. An attacker could possibly use this
issue to execute arbitrary code. This issue only affected
Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-37271)

Abhishek Govindarasu, Ankush Menat and Ward Theunisse discovered that
RestrictedPython did not correctly handle certain format strings. An
attacker could possibly use this issue to leak sensitive information.
This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
(CVE-2023-41039)

It was discovered that RestrictedPython did not correctly restrict access
to certain fields. An attacker could possibly use this issue to leak
sensitive information. (CVE-2024-47532)

It was discovered that RestrictedPython contained a type confusion
vulnerability. An attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 24.04 LTS and
Ubuntu 24.10. (CVE-2025-22153)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.10
   python3-restrictedpython        6.2-1ubuntu0.24.10.1

Ubuntu 24.04 LTS
   python3-restrictedpython        6.2-1ubuntu0.24.04.1~esm1
                                   Available with Ubuntu Pro

Ubuntu 22.04 LTS
   python3-restrictedpython        4.0~b3-3ubuntu0.1~esm1
                                   Available with Ubuntu Pro

Ubuntu 20.04 LTS
   python3-restrictedpython        4.0~b3-2ubuntu0.1~esm1
                                   Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-7355-1
   CVE-2023-37271, CVE-2023-41039, CVE-2024-47532, CVE-2025-22153

Package Information:
https://launchpad.net/ubuntu/+source/restrictedpython/6.2...



Attachment: OpenPGP_signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

wsD5BAABCAAjFiEEkd98mdFcnQdP7vQkuGrtzot7pOcFAmfaFMUFAwAAAAAACgkQuGrtzot7pOfI
Twv/dxKjv/+8jIPBGy8wLd2Hp/ffmG1LbCEly5KpEV5G4p3AFp8+AX2pJ+RI5znYXzJjpyEk/XPT
4l0CL3eZTS18GoEEKknSkundfPSCC/PXmvY2D4JVj5x6opz6SNK89S/gas6nBGgns0uMAD4Fv4uf
rkIgM8vFnRDllAy12mC1m0SWE9Q0pInIqR1RuP33qbYbF941dac7uS7wCN9lY3G2m/zqcnXKJ1h+
FtQfLywElX50TrmIsZPYtglpRWns4OKolU273p4A68CXdr0GiMf61gG4jBP1Rr0bKZTY6VZz4eC2
RFGT8zd7BQZI+Davr+R9nAGnyGXK9W4to+ogmAmhgRObJ6vSwaHlCMJmvVfQe1PwPLj15R5dmtt9
YhzWQdt88TY40il86VxuT9cOs+PHDDKJdaqE1WqQSnjnDTrx1DEc+m3nDzQw2oPc0YN9qWiUJ6KW
tffr7uxFnxzfMW6HISPjqPMGEumWBUHTWJtxDd1Xg43X2bOon+vFJqlC2WaH
=OhEf
-----END PGP SIGNATURE-----


Attachment: None (type=text/plain)