This update for python-asteval fixes the following issues:
Update to 1.0.6:
* drop testing and support for Python3.8, add Python 3.13, change
document to reflect this.
* implement safe_getattr and safe_format functions; fix bugs in
UNSAFE_ATTRS and UNSAFE_ATTRS_DTYPES usage (boo#1236405,
CVE-2025-24359)
* make all procedure attributes private to curb access to AST nodes,
which can be exploited
* improvements to error messages, including use ast functions to
construct better error messages
* remove import of numpy.linalg, as documented
* update doc description for security advisory
Update to 1.0.5:
* more work on handling errors, including fixing #133 and adding more
comprehensive tests for #129 and #132
Update to 1.0.4:
* fix error handling that might result in null exception
Update to 1.0.3:
* functions ("Procedures") defined within asteval have a ` _signature()`
...
Read the Full AdvisoryPatch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP6:
zypper in -t patch openSUSE-2025-52=1
- openSUSE Backports SLE-15-SP6 (noarch):
python311-asteval-1.0.6-bp156.4.3.1
https://www.suse.com/security/cve/CVE-2025-24359.html
https://bugzilla.suse.com/show_bug.cgi?id=1236405
Get the latest Linux and open source security news straight to your inbox.