GHSA-gmj9-h825-chq2: try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2025-22153

try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter

Package

pip RestrictedPython (pip)

Affected versions

>= 6.0, < 8.0

Impact

Via a type confusion bug in the CPython interpreter when using try/except* RestrictedPython could be bypassed.

We believe this should be fixed upstream in Python itself until that we remove support for try/except* from RestrictedPython.
(It has been fixed for some Python versions.)

Patches

Patched in version 8.0 by removing support for try/except* clauses

Workarounds

There is no workaround.

References

none

References

• GHSA-gmj9-h825-chq2
• zopefoundation/RestrictedPython@48a92c5

Published to the GitHub Advisory Database

Jan 23, 2025

Last updated

Jan 23, 2025