🛡️ CVE-2023-37271 on Debian — restrictedpython

⚪ Unknown ✅ No Known Exploit OSV
N/A
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

RestrictedPython is a tool that helps to define a subset of the Python language which allows users to provide a program input into a trusted environment. RestrictedPython does not check access to stack frames and their attributes. Stack frames are accessible within at least generators and generator expressions, which are allowed inside RestrictedPython. Prior to versions 6.1 and 5.3, an attacker with access to a RestrictedPython environment can write code that gets the current stack frame in a generator and then walk the stack all the way beyond the RestrictedPython invocation boundary, thus breaking out of the restricted sandbox and potentially allowing arbitrary code execution in the Python interpreter. All RestrictedPython deployments that allow untrusted users to write Python code in the RestrictedPython environment are at risk. In terms of Zope and Plone, this would mean deployments where the administrator allows untrusted users to create and/or edit objects of type Script (Python), DTML Method, DTML Document or Zope Page Template. This is a non-default configuration and likely to be extremely rare. The problem has been fixed in versions 6.1 and 5.3.

Distribution advisory

This page covers CVE-2023-37271 as tracked by Debian, for the package restrictedpython. The fix is available in version 6.2-1; earlier versions remain affected.

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs low-level privileges on the target. No user interaction is required. The scope is changed, meaning a successful attack can affect components beyond the vulnerable one. Rated impact: confidentiality high, integrity high, availability high.

Weakness class

DEBIAN-CVE-2023-37271 is classified as CWE-913: Improper Control of Dynamically-Managed Code Resources. Attacker input reaches variables, objects or code that the runtime manages dynamically.

Affected software

DEBIAN-CVE-2023-37271 is recorded against 1 package.

  • restrictedpython (fixed in 6.2-1)

Timeline and source

Published on 11 July 2023 and last revised on 7 August 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

security-tracker.debian.org (Advisory)

CVE-2023-37271 on other distributions

Each distribution ships its own build and its own fixed version. Pick the one you run:

Details

Severity Unknown
CVSS Score N/A
CVSS Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE N/A
Public Exploit ✅ No
Source OSV
Published 2023-07-11
Updated 2026-08-12
Modified 2026-08-07
Fix URL N/A

Affected Packages

Software From version Fixed in
restrictedpython — 6.2-1

Similar Threats

Site Security Check

Is restrictedpython part of your stack?

DEBIAN-CVE-2023-37271 is rated CVSS 8.0 High. BotEraser scans your installation against known CVE records and tells you whether this vulnerability applies to the versions you actually run.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Browse related advisories

All advisoriesDebianDebian 2023