CVE-2019-19275: Out-of-bounds read in typed-ast and cpython
Summary
CVE-2019-19275: typed-ast Out-of-bounds Read. Affects typed-ast versions >= 1.3.0, < 1.3.2. Fixed in 1.3.2. How to fix ↓
Also tracked for
- python3-typed-ast · Debian:11
The same CVE-2019-19275 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package under scrutiny is typed-ast, which is an abstract syntax tree (AST) representation of Python source code. It provides a way to analyze and manipulate Python code programmatically. The vulnerability affects versions 1.3.0 and 1.3.1 of typed-ast. This vulnerability can be exploited by an attacker who can cause a Python interpreter to parse Python source code, potentially leading to a crash of the interpreter process. This issue is particularly concerning in web-based services that parse Python code without executing it. It should be noted that certain Python 3.8.0-alpha prereleases are also affected.
Vulnerability Detail
The vulnerability, identified as CVE-2019-19275, is an out-of-bounds read in the ast_for_arguments function of typed-ast and cpython. An attacker with the ability to make a Python interpreter parse Python source code (without executing it) can trigger this vulnerability. By exploiting this issue, the attacker can crash the interpreter process. This vulnerability has a CVSS score of 7.5, indicating a high severity level. It is important to address this vulnerability promptly to prevent potential crashes and ensure the stability of the Python interpreter.
How To Fix
Minimum fixed version
1.3.2
This is the first release that contains the fix.
pip install --upgrade "typed-ast==1.3.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, it is advisable to avoid parsing untrusted Python code in web-based services or any other context where the code is not executed. By limiting the exposure to potentially malicious code, the risk of triggering this vulnerability can be minimized.
Conclusion
In conclusion, the CVE-2019-19275 vulnerability in typed-ast and cpython can lead to a crash of the Python interpreter process. It is crucial to upgrade to a secure version of typed-ast (1.4.0 or later) to mitigate this vulnerability. Avoiding the parsing of untrusted Python code can also minimize the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typed-ast →
FAQ
Typed-ast is an abstract syntax tree representation of Python source code. It allows for programmatic analysis and manipulation of Python code.
Versions 1.3.0 and 1.3.1 of typed-ast are affected by this vulnerability.
No, this vulnerability requires the ability to make a Python interpreter parse Python source code, but not necessarily execute it. Therefore, it cannot be exploited remotely.
The impact of this vulnerability is the potential crash of the Python interpreter process. This can disrupt the functionality of applications or services that rely on the interpreter.
Yes, upgrading typed-ast to version 1.4.0 or later will fix this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for typed-ast.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
