Alerts This Week
Warning Icon 1 666
Alerts This Week
Warning Icon 1 666

Mageia 7 Security Update: MGASA-2020-0249 Critical Fix for Python-Typed-Ast

mageia
Calendar Grey June 10, 2020
Dist Mageia Esm H88
Revised python-typed-ast libraries tackle vulnerabilities linked to possible system failures in online applications.
Advisory text to describe the update

Summary

Advisory text to describe the update. Wrap lines at ~75 chars. Updated python-typed-ast package fixes security vulnerabilities:
typed_ast 1.3.0 and 1.3.1 has a handle_keywordonly_args out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code (CVE-2019-19274).
typed_ast 1.3.0 and 1.3.1 has an ast_for_arguments out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code (CVE-2019-19275).

References

- https://bugs.mageia.org/show_bug.cgi?id=26590

- - https://www.cve.org/CVERecord?id=CVE-2019-19274

- https://www.cve.org/CVERecord?id=CVE-2019-19275

Resolution

SRPMS

- 7/core/python-typed-ast-1.3.1-1.1.mga7

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 10 Jun 2020
URL: https://advisories.mageia.org/MGASA-2020-0249.html
Type: security
CVE: CVE-2019-19274, CVE-2019-19275

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here