USN-7355-1: RestrictedPython vulnerabilities

USN-7355-1: RestrictedPython vulnerabilities
18 March 2025

Several security issues were fixed in RestrictedPython.

Releases
Ubuntu 24.10 Ubuntu 24.04 LTS Ubuntu 22.04 LTS Ubuntu 20.04 LTS

Packages
restrictedpython - Restricted execution environment for Python 3

Details
Nakul Choudhary and Robert Xiao discovered that RestrictedPython did not
properly sanitize certain inputs. An attacker could possibly use this
issue to execute arbitrary code. This issue only affected
Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-37271)

Abhishek Govindarasu, Ankush Menat and Ward Theunisse discovered that
RestrictedPython did not correctly handle certain format strings. An
attacker could possibly use this issue to leak sensitive information.
This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
(CVE-2023-41039)

It was discovered that RestrictedPython did not correctly restrict access
to certain fields. An attacker could possibly use this issue to leak
sensitive information. (CVE-2024-47532)

It was discovered that RestrictedPython contained a type confusion
vulnerability. An attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 24.04 LTS and
Ubuntu 24.10. (CVE-2025-22153)

Update instructions
The problem can be corrected by updating your system to the following package versions:

Ubuntu 24.10

• python3-restrictedpython - 6.2-1ubuntu0.24.10.1
  Ubuntu 24.04
• python3-restrictedpython - 6.2-1ubuntu0.24.04.1~esm1
  Ubuntu 22.04
• python3-restrictedpython - 4.0~b3-3ubuntu0.1~esm1
  Ubuntu 20.04
• python3-restrictedpython - 4.0~b3-2ubuntu0.1~esm1
  In general, a standard system update will make all the necessary changes.