CVE-2025-22153

Katalog CVE

CVSS 7.9 · High EPSS 0,40%

Kerentanan Access of Resource Using Incompatible Type ('Type Confusion'). Skor CVSS 3.1 7.9 (High) menurut github.com.

Deskripsi (NVD)

RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type confusion bug in versions of the CPython interpreter starting in 3.11 and prior to 3.13.2 when using `try/except*`, RestrictedPython starting in version 6.0 and prior to version 8.0 could be bypassed. The issue is patched in version 8.0 of RestrictedPython by removing support for `try/except*` clauses. No known workarounds are available.

Rincian

Terbit di NVD

23 Januari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

7.9 (High), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/zopefoundation/RestrictedPython/commit/48a92c5bb617a647cffd0dadd4d5cfe626bcdb2f
• https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-gmj9-h825-chq2