CVE-2019-19274: High severity python typed ast vulnerability
typedast 1.3.0 and 1.3.1 has a handlekeywordonlyargs out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.)
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-19274?
CVE-2019-19274 has a moderate severity level due to the potential for crashing the Python interpreter.
How do I fix CVE-2019-19274?
To fix CVE-2019-19274, upgrade typed-ast to version 1.3.2 or later.
What software is affected by CVE-2019-19274?
CVE-2019-19274 affects typed_ast versions 1.3.0 and 1.3.1.
What type of vulnerability is CVE-2019-19274?
CVE-2019-19274 is an out-of-bounds read vulnerability caused by incorrect handling of keyword-only arguments.
Who can exploit CVE-2019-19274?
An attacker with the ability to send Python source code to the interpreter can exploit CVE-2019-19274.