Out-of-bounds Read Vulnerability in typed_ast for Python by Python Software Foundation

CVE-2019-19274

What is CVE-2019-19274?

The typed_ast library versions 1.3.0 and 1.3.1 are affected by an out-of-bounds read in the handle_keywordonly_args function. This vulnerability allows an attacker to manipulate a Python interpreter to parse source code that could potentially crash the interpreter process. This scenario poses a risk for applications or services that parse Python code, especially in web environments where execution may not occur but parsing does. Further investigation into this issue is necessary for all applications utilizing these versions of typed_ast.

References