OPENSUSE-SU-2025:0052-1 Security update for python-asteval

This update for python-asteval fixes the following issues: Update to 1.0.6: drop testing and support for Python3.8, add Python 3.13, change document to reflect this. implement safegetattr and safeformat functions; fix bugs in UNSAFEATTRS and UNSAFEATTRSDTYPES usage boo1236405, CVE-2025-24359 make...

SUSE CVE-2025-24359

ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the asteval library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. The vulnerability is...

ASTEVAL Allows Maliciously Crafted Format Strings to Lead to Sandbox Escape

Summary If an attacker can control the input to the asteval library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. Details The vulnerability is rooted in how asteval performs handling of FormattedValue AST nodes. In...

GHSA-3WWR-3G9F-9GC7 ASTEVAL Allows Maliciously Crafted Format Strings to Lead to Sandbox Escape

Summary If an attacker can control the input to the asteval library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. Details The vulnerability is rooted in how asteval performs handling of FormattedValue AST nodes. In...

eunomia (>=0.0.1.dev6, <=0.0.1.dev12), molmag-ac-gui (>=0.1.0, <=0.2.5) potentially affected by CVE-2025-24359 via asteval (0.9.21)

asteval PYPI version 0.9.21 is affected by a known vulnerability. The following packages have a transitive dependency on asteval and may be impacted: - eunomia =0.0.1.dev6, =0.1.0, =0.2.5 Source cves: CVE-2025-24359 Source advisory: OSV:GHSA-3WWR-3G9F-9GC7...

eunomia (>=0.0.1.dev15, <=0.0.1.dev20) potentially affected by CVE-2025-24359 via asteval (0.9.22)

asteval PYPI version 0.9.22 is affected by a known vulnerability. The following packages have a transitive dependency on asteval and may be impacted: - eunomia =0.0.1.dev15, =0.0.1.dev20 Source cves: CVE-2025-24359 Source advisory: OSV:GHSA-3WWR-3G9F-9GC7...

gs-quant (>=0.8.305, <=1.0.51), resolwe (>=28.2.1, <=29.3.0) +1 more potentially affected by CVE-2025-24359 via asteval (0.9.23)

asteval PYPI version 0.9.23 is affected by a known vulnerability. The following packages have a transitive dependency on asteval and may be impacted: - gs-quant =0.8.305, =28.2.1, =37.0.0, =43.0.0 Source cves: CVE-2025-24359 Source advisory: OSV:GHSA-3WWR-3G9F-9GC7...

resolwe (>=30.0.0a1, <=35.2.0a1), resolwe-bio (>=44.0.0a1, <=52.1.0) potentially affected by CVE-2025-24359 via asteval (0.9.26)

asteval PYPI version 0.9.26 is affected by a known vulnerability. The following packages have a transitive dependency on asteval and may be impacted: - resolwe =30.0.0a1, =44.0.0a1, =52.1.0 Source cves: CVE-2025-24359 Source advisory: OSV:GHSA-3WWR-3G9F-9GC7...

resolwe (>=36.0.0a1, <=40.0.0), resolwe-bio (>=0.0.0, <=57.0.1) potentially affected by CVE-2025-24359 via asteval (0.9.29)

asteval PYPI version 0.9.29 is affected by a known vulnerability. The following packages have a transitive dependency on asteval and may be impacted: - resolwe =36.0.0a1, =0.0.0, =57.0.1 Source cves: CVE-2025-24359 Source advisory: OSV:GHSA-3WWR-3G9F-9GC7...

kalkon (>=0.1.0, <=0.4.0) potentially affected by CVE-2025-24359 via asteval (0.9.31)

asteval PYPI version 0.9.31 is affected by a known vulnerability. The following packages have a transitive dependency on asteval and may be impacted: - kalkon =0.1.0, =0.4.0 Source cves: CVE-2025-24359 Source advisory: OSV:GHSA-3WWR-3G9F-9GC7...

agent-smith-ai (>=0.9.2, <=1.0.1), bibliomancer (0.1.0) +24 more potentially affected by CVE-2025-24359 via asteval (0.9.33)

asteval PYPI version 0.9.33 is affected by a known vulnerability. The following packages have a transitive dependency on asteval and may be impacted: - agent-smith-ai =0.9.2, =0.2.0rc0, =0.1.0, =0.2.0, =0.1.0, =2.1.3, =2.1.0b2, =2.5.1, =0.4.0, =0.1.4, =0.7.0, =0.3.0, =0.5.0 and more Source cves:...

awslabs-ccapi-mcp-server (>=1.0.1, <=1.0.18), bridgecrew (>=3.2.415, <=3.2.477) +10 more potentially affected by CVE-2025-24359 via asteval (1.0.5)

asteval PYPI version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on asteval and may be impacted: - awslabs-ccapi-mcp-server =1.0.1, =3.2.415, =3.2.415, =0.1.130, =6.0.0, =5.8.0, =5.8.0, =0.0.8, =0.1.0, =0.31.0 Source cves: CVE-2025-24359 Source...

awslabs-ccapi-mcp-server (>=1.0.1, <=1.0.18), bridgecrew (>=3.2.415, <=3.2.477) +10 more potentially affected by CVE-2025-24359 via asteval (1.0.5)

asteval PYPI version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on asteval and may be impacted: - awslabs-ccapi-mcp-server =1.0.1, =3.2.415, =3.2.415, =0.1.130, =6.0.0, =5.8.0, =5.8.0, =0.0.8, =0.1.0, =0.31.0 Source cves: CVE-2025-24359 Source...

awslabs-ccapi-mcp-server (>=1.0.1, <=1.0.18), bridgecrew (>=3.2.415, <=3.2.477) +10 more potentially affected by CVE-2025-24359 via asteval (1.0.5)

asteval PYPI version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on asteval and may be impacted: - awslabs-ccapi-mcp-server =1.0.1, =3.2.415, =3.2.415, =0.1.130, =6.0.0, =5.8.0, =5.8.0, =0.0.8, =0.1.0, =0.31.0 Source cves: CVE-2025-24359 Source...

Exposed Dangerous Method or Function

Overview asteval is a Safe, minimalistic evaluator of python expression using ast module Affected versions of this package are vulnerable to Exposed Dangerous Method or Function through the onformattedvalue function. An attacker can manipulate the value of the string used in the dangerous call...

CVE-2025-24359

ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the asteval library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. The vulnerability is...

UBUNTU-CVE-2025-24359

ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the asteval library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. The vulnerability is...

CVE-2025-24359 ASTEVAL Vulnerable to Maliciously Crafted Format Strings Leading to Sandbox Escape

ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the asteval library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. The vulnerability is...

CVE-2025-24359 ASTEVAL Vulnerable to Maliciously Crafted Format Strings Leading to Sandbox Escape

ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the asteval library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. The vulnerability is...

CVE-2025-24359

ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the "asteval" library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. The vulnerability is...