CVE-2019-19274: python typed_ast Out-of-bounds Read
Vulnerability summary
CVE-2019-19274 is a high (CVSS 7.5) Out-of-bounds Read vulnerability in python typed_ast. EPSS estimates a 3.28% chance of exploitation in the next 30 days, higher than 88.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 26-11-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
typed_ast 1.3.0 and 1.3.1 has a handle_keywordonly_args out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.)
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
3.28%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
0.00 pp
From 3.28% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- python3-typed-ast< 1.4.0-1
PyPI1 product
- typed-ast≥ 1.3.0, < 1.3.2 | < dc317ac9cff859aa84eeabe03fb5004982545b3b | < a4d78362397fc3bced6ea80fbc7b5f4827aec55e | < 1.3.2
Python1 product
- typed_ast1.3.0 | 1.3.1
Ubuntu1 product
- python3-typed-astAll versions (No fix recorded)
4 vendors · 4 products
References
15 links- github.com/python/typed_ast/commit/156afcb26c198e162504a57caddfe0acd9ed7dceX Refsource MISCWEBFIXREPORTPatchThird Party Advisory
- github.com/python/cpython/commit/dcfcd146f8e6fc5c2fc16a4c192a0c5f5ca8c53cX Refsource MISCWEBFIXREPORTPatchThird Party Advisory
- github.com/python/cpython/commit/a4d78362397fc3bced6ea80fbc7b5f4827aec55eX Refsource MISCWEBFIXREPORTPatchThird Party Advisory
- github.com/python/typed_ast/commit/dc317ac9cff859aa84eeabe03fb5004982545b3bX Refsource MISCWEBFIXREPORTPatchThird Party Advisory
- github.com/python/typed_astPACKAGE
