CVE-2019-19275: High severity python typed ast vulnerability
typedast 1.3.0 and 1.3.1 has an astforarguments out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.)
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-19275?
CVE-2019-19275 has been assigned a moderate severity level due to its potential to crash the Python interpreter.
How do I fix CVE-2019-19275?
To mitigate CVE-2019-19275, upgrade typed_ast to version 1.3.2 or later.
Which versions are affected by CVE-2019-19275?
CVE-2019-19275 affects typed_ast versions 1.3.0 and 1.3.1.
What impact does CVE-2019-19275 have?
CVE-2019-19275 could allow an attacker to cause an out-of-bounds read, potentially crashing the interpreter process.
Can CVE-2019-19275 be exploited remotely?
CVE-2019-19275 can be exploited if an attacker can cause a Python interpreter to parse malicious Python source code.