CVE-2023-41050 Information disclosure through Python's "format" functionality in Zope AccessControl
Attackers can read sensitive object attributes via unsafe str.format_map usage in Zope AccessControl, leading to information disclosure.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-41050?
CVE-2023-41050 is a medium-severity vulnerability in zopefoundation AccessControl, published on 6 Sep 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown `getattr` and `getitem`, not the policy restricted `AccessControl` variants `_getattr_` and `_getitem_`. This can lead to critical information disclosure. `AccessControl` already provides a safe variant for `str.format` and denies access to `string.Formatter`. However, `str.format_map` is still unsafe. Affected are all users who allow untrusted users to create `AccessControl` controlled Python code and execute it. A fix has been introduced in versions 4.4, 5.8 and 6.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-200
Which versions are affected by CVE-2023-41050?
12 open source packages ship an affected version, including accesscontrol, AccessControl and Zope. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
accesscontrol PyPI | All versions | 4.4, 5.8, 6.2 |
accesscontrol PyPI | All versions | 4.4 |
accesscontrol PyPI | From 5.0 | 5.8 |
accesscontrol PyPI | From 6.0 | 6.2 |
AccessControl PyPI | All versions | 4.4 |
AccessControl PyPI | From 5.0 | 5.8 |
6 more packages
AccessControl PyPI | From 6.0 | 6.2 |
Zope PyPI | All versions | 4.8.9 |
Zope PyPI | From 5.0.0 | 5.8.4 |
zope PyPI | All versions | 4.8.9, 5.8.4 |
zope PyPI | All versions | 4.8.9 |
zope PyPI | From 5.0.0 | 5.8.4 |
Products include Zope Accesscontrol, Zope Zope.
How do I fix CVE-2023-41050?
Upgrade accesscontrol to a fixed version for your release line: 4.4, 5.8 or 6.2.
Is CVE-2023-41050 being exploited?
There is no known exploitation of CVE-2023-41050 in the wild and no public exploit code.
Other vulnerabilities in zopefoundation AccessControl
Sources
Also known as GHSA-8xv7-89vj-q48c, PYSEC-2026-2075, PYSEC-2026-2325.