CVE-2023-37271

Summary

CVE-2023-37271 is a vulnerability affecting RestrictedPython, a tool used to define a subset of Python for trusted environments. Prior to versions 6.1 and 5.3, this software failed to secure stack frames and their attributes, making them accessible within generators and generator expressions. An attacker in a RestrictedPython environment could exploit this flaw to bypass the sandbox and potentially execute arbitrary code in the Python interpreter. Systems deploying Zope or Plone with untrusted users able to create or edit specific object types - `Script (Python)`, `DTML Method`, `DTML Document`, or `Zope Page Template` - are susceptible to this issue. However, it's worth noting that this non-default configuration is likely rare. The vulnerability has been resolved in versions 6.1 and 5.3.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.