{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for python-asteval",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for python-asteval fixes the following issues:\n\nUpdate to 1.0.6:\n\n  * drop testing and support for Python3.8, add Python 3.13,\n    change document to reflect this.\n  * implement safe_getattr and safe_format functions; fix bugs\n    in UNSAFE_ATTRS and UNSAFE_ATTRS_DTYPES usage (boo#1236405,\n    CVE-2025-24359)\n  * make all procedure attributes private to curb access to AST\n    nodes, which can be exploited\n  * improvements to error messages, including use ast functions\n    to construct better error messages\n  * remove import of numpy.linalg, as documented\n  * update doc description for security advisory\n\nUpdate to 1.0.5:\n\n  * more work on handling errors, including fixing #133 and\n    adding more comprehensive tests for #129 and #132\n\nUpdate to 1.0.4:\n\n  * fix error handling that might result in null exception\n\nUpdate to 1.0.3:\n\n  * functions (\u0027Procedures\u0027) defined within asteval have a `\n    _signature()` method, now use in repr\n  * add support for deleting subscript\n  * nested symbol tables now have a  Group() function\n  * update coverage config\n  * cleanups of exception handling :  errors must now have an\n    exception\n  * several related fixes to suppress repeated exceptions: see GH\n    #132 and #129\n  * make non-boolean return values from comparison operators\n    behave like Python - not immediately testing as bool\n\n- update to 1.0.2:\n  * fix NameError handling in expression code\n  * make exception messages more Python-like\n- update to 1.0.1:\n  * security fixes, based on audit by Andrew Effenhauser, Ayman\n    Hammad, and Daniel Crowley, IBM X-Force Security Research\n    division\n  * remove numpy modules polynomial, fft, linalg by default for\n    security concerns\n  * disallow string.format(), improve security of f-string\n    evaluation\n\n- update to 1.0.0:\n  * fix (again) nested list comprehension (Issues #127 and #126).\n  * add more testing of multiple list comprehensions.\n  * more complete support for Numpy 2, and removal of many Numpy\n    symbols that have been long deprecated.\n  * remove AST nodes deprecated in Python 3.8.\n  * clean up build files and outdated tests.\n  * fixes to codecov configuration.\n  * update docs.\n\n- update to 0.9.33:\n  * fixes for multiple list comprehensions (addressing #126)\n  * add testing with optionally installed numpy_financial to CI\n  * test existence of all numpy imports to better safeguard\n    against missing functions (for safer numpy 2 transition)\n  * update rendered doc to include PDF and zipped HTML\n\n- update to 0.9.32:\n  * add deprecations message for numpy functions to be removed in\n    numpy 2.0\n  * comparison operations use try/except for short-circuiting\n    instead of checking for numpy arrays (addressing #123)\n  * add Python 3.12 to testing\n  * move repository from \u0027newville\u0027 to \u0027lmfit\u0027 organization\n  * update doc theme, GitHub locations pointed to by docs, other\n    doc tweaks.\n\n- Update to 0.9.31:\n  * cleanup numpy imports to avoid deprecated functions, add financial\n  functions from numpy_financial module, if installed.\n  * prefer \u0027user_symbols\u0027 when initializing Interpreter, but still support\n  \u0027usersyms\u0027 argument. Will deprecate and remove eventually.\n  * add support of optional (off-by default) \u0027nested symbol table\u0027.\n  * update tests to run most tests with symbol tables of dict and nested\n  group type.\n  * general code and testing cleanup.\n  * add config argument to Interpreter to more fully control which nodes are supported\n  * add support for import and importfrom -- off by default\n  * add support for with blocks\n  * add support for f-strings\n  * add support of set and dict comprehension\n  * fix bug with \u0027int**int\u0027 not returning a float.\n\n- update to 0.9.29:\n  * bug fixes\n\n- Update to 0.9.28\n  * add support for Python 3.11\n  * add support for multiple list comprehensions\n  * improve performance of making the initial symbol table,\n    and Interpreter creation, including better checking for index_tricks attributes\n\n- update to 0.9.27:\n  * more cleanups\n\n- update to 0.9.26:\n  * fix setup.py again\n\n- update to 0.9.25:\n  * fixes import errors for Py3.6 and 3.7, setting version with\n    importlib_metadata.version if available.\n  * use setuptools_scm and importlib for version\n  * treat all __dunder__ attributes of all objects as inherently unsafe.\n\n- Update to 0.9.22\n  * another important but small fix for Python 3.9\n  * Merge branch \u0027nested_interrupts_returns\u0027\n- Drop hard numpy requirement, don\u0027t test on python36\n\n- update to 0.9.18\n  * drop python2\n  * few fixes\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2025-52",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_0052-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2025:0052-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/S3ET4NHUOZVYKROXRFLTLBVGPX32M46Q/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2025:0052-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/S3ET4NHUOZVYKROXRFLTLBVGPX32M46Q/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1236405",
        "url": "https://bugzilla.suse.com/1236405"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-24359 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-24359/"
      }
    ],
    "title": "Security update for python-asteval",
    "tracking": {
      "current_release_date": "2026-09-20T21:23:29Z",
      "generator": {
        "date": "2025-02-03T19:01:08Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2025:0052-1",
      "initial_release_date": "2025-02-03T19:01:08Z",
      "revision_history": [
        {
          "date": "2025-02-03T19:01:08Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T21:23:29Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python311-asteval-0:1.0.6-bp156.4.3.1.noarch",
                "product": {
                  "name": "python311-asteval-0:1.0.6-bp156.4.3.1.noarch",
                  "product_id": "python311-asteval-0:1.0.6-bp156.4.3.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python311-asteval@1.0.6-bp156.4.3.1?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Package Hub 15 SP6",
                "product": {
                  "name": "SUSE Package Hub 15 SP6",
                  "product_id": "SUSE Package Hub 15 SP6"
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.6",
                "product": {
                  "name": "openSUSE Leap 15.6",
                  "product_id": "openSUSE Leap 15.6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-asteval-0:1.0.6-bp156.4.3.1.noarch as component of SUSE Package Hub 15 SP6",
          "product_id": "SUSE Package Hub 15 SP6:python311-asteval-0:1.0.6-bp156.4.3.1.noarch"
        },
        "product_reference": "python311-asteval-0:1.0.6-bp156.4.3.1.noarch",
        "relates_to_product_reference": "SUSE Package Hub 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-asteval-0:1.0.6-bp156.4.3.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:python311-asteval-0:1.0.6-bp156.4.3.1.noarch"
        },
        "product_reference": "python311-asteval-0:1.0.6-bp156.4.3.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-24359",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-24359"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the `asteval` library, they can bypass asteval\u0027s restrictions and execute arbitrary Python code in the context of the application using the library. The vulnerability is rooted in how `asteval` performs handling of `FormattedValue` AST nodes. In particular, the `on_formattedvalue` value uses the dangerous format method of the str class. The code allows an attacker to manipulate the value of the string used in the dangerous call `fmt.format(__fstring__=val)`. This vulnerability can be exploited to access protected attributes by intentionally triggering an `AttributeError` exception. The attacker can then catch the exception and use its `obj` attribute to gain arbitrary access to sensitive or protected object properties. Version 1.0.6 fixes this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP6:python311-asteval-0:1.0.6-bp156.4.3.1.noarch",
          "openSUSE Leap 15.6:python311-asteval-0:1.0.6-bp156.4.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-24359",
          "url": "https://www.suse.com/security/cve/CVE-2025-24359"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236405 for CVE-2025-24359",
          "url": "https://bugzilla.suse.com/1236405"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP6:python311-asteval-0:1.0.6-bp156.4.3.1.noarch",
            "openSUSE Leap 15.6:python311-asteval-0:1.0.6-bp156.4.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-02-03T19:01:08Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-24359"
    }
  ]
}