Out-of-Bounds Read Vulnerability in typed_ast
Summary
CVE-2019-19275: typed_ast 1.3.0 and 1.3.1 has an ast_for_arguments out-of-bounds read. Affects python3-typed-ast across 5 version ranges.
< 1.4.0-1
< 156afcb26c198e162504a57caddfe0acd9ed7dce
< a4d78362397fc3bced6ea80fbc7b5f4827aec55e
< dc317ac9cff859aa84eeabe03fb5004982545b3b
< dcfcd146f8e6fc5c2fc16a4c192a0c5f5ca8c53c
Fixed in 1.4.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
typed_ast is a Python package that provides a Python 3 compatible AST (Abstract Syntax Tree) representation of Python source code. It is commonly used by tools that analyze or manipulate Python code. The package is vulnerable to an out-of-bounds read issue, which can be triggered when parsing Python source code. This vulnerability can potentially lead to a crash of the Python interpreter process. Although it does not directly allow code execution, it can be a concern in web-based services that parse Python code without executing it. The vulnerability also affects certain prerelease versions of Python 3.8.0.
Vulnerability Detail
The out-of-bounds read vulnerability in typed_ast arises due to an issue in the ast_for_arguments function. An attacker who can make a Python interpreter parse Python source code, but not necessarily execute it, may be able to exploit this vulnerability and crash the interpreter process. This can be particularly problematic in web-based services that parse Python code without executing it. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1.4.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python3-typed-astTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The out-of-bounds read vulnerability in typed_ast can potentially lead to a crash of the Python interpreter process. It is recommended to update the python3-typed-ast package to version 1.4.0-1 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python3-typed-ast →
FAQ
typed_ast is a Python package that provides an AST representation of Python source code. It is commonly used by tools that analyze or manipulate Python code.
An out-of-bounds read vulnerability occurs when a program accesses memory outside the bounds of a defined buffer. In this case, the vulnerability in typed_ast allows an attacker to read memory beyond the intended boundaries, potentially leading to a crash of the Python interpreter process.
No, this vulnerability does not directly allow the execution of arbitrary code. However, it can be used to crash the Python interpreter process, which can be a concern in certain scenarios.
The vulnerability affects typed_ast versions 1.3.0 and 1.3.1. It also affects certain prerelease versions of Python 3.8.0.
The vulnerability has a CVSS score of 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3-typed-ast.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
