Mageia: Security Advisory (MGASA-2020-0249)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Updated python-typed-ast packages fix security vulnerability

Updated python-typed-ast package fixes security vulnerabilities: typedast 1.3.0 and 1.3.1 has a handlekeywordonlyargs out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source but not necessarily execute it may be able to crash the interpreter process...

OPENSUSE-SU-2020:0609-1 Security update for python-typed-ast

This update for python-typed-ast fixes the following issues: python-typed-ast was reverted to version 1.3.1 because it broke another package bsc1163532. Security issues fixed: - CVE-2019-19274: Fixed an out-of-bounds read bsc1161562. - CVE-2019-19275: Fixed an out-of-bounds read bsc1161563. This...

openSUSE Security Update : python-typed-ast (openSUSE-2020-567)

This update for python-typed-ast fixes the following issues : python-typed-ast was reverted to version 1.3.1 because it broke another package bsc1163532. Security issues fixed : - CVE-2019-19274: Fixed an out-of-bounds read bsc1161562. - CVE-2019-19275: Fixed an out-of-bounds read bsc1161563. C...

Security update for python-typed-ast (low)

openSUSE Security Update: Security update for python-typed-ast Announcement ID: openSUSE-SU-2020:0609-1 Rating: low References: 1161562 1161563 1163532 Cross-References: CVE-2019-19274 CVE-2019-19275 Affected Products: openSUSE Backports SLE-15-SP1 An update that solves two vulnerabilities and ha...

OPENSUSE-SU-2020:0567-1 Security update for python-typed-ast

This update for python-typed-ast fixes the following issues: python-typed-ast was reverted to version 1.3.1 because it broke another package bsc1163532. Security issues fixed: - CVE-2019-19274: Fixed an out-of-bounds read bsc1161562. - CVE-2019-19275: Fixed an out-of-bounds read bsc1161563...

Security update for python-typed-ast (low)

openSUSE Security Update: Security update for python-typed-ast Announcement ID: openSUSE-SU-2020:0567-1 Rating: low References: 1161562 1161563 1163532 Cross-References: CVE-2019-19274 CVE-2019-19275 Affected Products: openSUSE Leap 15.1 An update that solves two vulnerabilities and has one errat...

Fedora: Security Advisory for python3-typed_ast (FEDORA-2020-9b3dabc21c)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Internet Bug Bounty: Two out-of-bounds array reads in Python AST builder (Re-opening 520612 with CVEs)

I'm re-submitting 520612 after getting CVEs issued, as instructed in an automated email from November 17th. Getting CVEs issued took a while, but here they are: - https://vulners.com/cve/CVE-2019-19274 - https://vulners.com/cve/CVE-2019-19275 Impact A service that takes Python snippets as payload...

CVE-2019-19274

typedast 1.3.0 and 1.3.1 has a handlekeywordonlyargs out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source but not necessarily execute it may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that...

UBUNTU-CVE-2019-19274

typedast 1.3.0 and 1.3.1 has a handlekeywordonlyargs out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source but not necessarily execute it may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that...

CVE-2019-19274

CVE-2019-19274 concerns typed_ast versions 1.3.0 and 1.3.1 with a handle_keywordonly_args out-of-bounds read. The vulnerability could crash a Python interpreter that parses Python source (without execution), e.g., in web-based parsing services. Several advisories note fixes for CVE-2019-19274 (an...

CVE-2019-19274

typedast 1.3.0 and 1.3.1 has a handlekeywordonlyargs out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source but not necessarily execute it may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that...