CVE-2024-47532

Publication date 30 September 2024

Last updated 3 July 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

6.5 · Medium

Score breakdown

RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module. The problem will be fixed in version 7.3. As a workaround, If the application does not require access to the module string, it can remove it from RestrictedPython.Utilities.utility_builtins or otherwise do not make it available in the restricted execution environment.

Status

Package Ubuntu Release Status
restrictedpython 25.04 plucky
Not affected
24.10 oracular
Fixed 6.2-1ubuntu0.24.10.1
24.04 LTS noble
Fixed 6.2-1ubuntu0.24.04.1~esm1
22.04 LTS jammy
Fixed 4.0~b3-3ubuntu0.1~esm1
20.04 LTS focal
Fixed 4.0~b3-2ubuntu0.1~esm1
18.04 LTS bionic
Not affected
16.04 LTS xenial
Not affected

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro

Severity score breakdown

Parameter Value
Base score 6.5 · Medium
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality High
Integrity impact None
Availability impact None
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N