Alerts This Week
Warning Icon 1 664
Alerts This Week
Warning Icon 1 664

openSUSE: 2025:0052-1 moderate: python-asteval security advisory

opensuse
Calendar Grey February 3, 2025
Dist Opensuse Esm H88
This Fedora security patch resolves a significant flaw in python-eval, improving total system protection.
An update that fixes one vulnerability is now available

Description

This update for python-asteval fixes the following issues:

Update to 1.0.6:

* drop testing and support for Python3.8, add Python 3.13, change

document to reflect this.

* implement safe_getattr and safe_format functions; fix bugs in

UNSAFE_ATTRS and UNSAFE_ATTRS_DTYPES usage (boo#1236405,

CVE-2025-24359)

* make all procedure attributes private to curb access to AST nodes,

which can be exploited

* improvements to error messages, including use ast functions to

construct better error messages

* remove import of numpy.linalg, as documented

* update doc description for security advisory

Update to 1.0.5:

* more work on handling errors, including fixing #133 and adding more

comprehensive tests for #129 and #132

Update to 1.0.4:

* fix error handling that might result in null exception

Update to 1.0.3:

* functions ("Procedures") defined within asteval have a ` _signature()`

...

Read the Full Advisory

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Backports SLE-15-SP6:

zypper in -t patch openSUSE-2025-52=1

Package List

- openSUSE Backports SLE-15-SP6 (noarch):

python311-asteval-1.0.6-bp156.4.3.1

References

https://www.suse.com/security/cve/CVE-2025-24359.html

https://bugzilla.suse.com/show_bug.cgi?id=1236405

Announcement ID: openSUSE-SU-2025:0052-1
Rating: moderate
Affected Products: openSUSE Backports SLE-15-SP6 .

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here