Security update for python-typed-ast SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2020:0609-1 Final 1 1 2020-05-04T10:13:43Z current 2020-05-04T10:13:43Z 2020-05-04T10:13:43Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python-typed-ast This update for python-typed-ast fixes the following issues: python-typed-ast was reverted to version 1.3.1 because it broke another package (bsc#1163532). Security issues fixed: - CVE-2019-19274: Fixed an out-of-bounds read (bsc#1161562). - CVE-2019-19275: Fixed an out-of-bounds read (bsc#1161563). This update was imported from the openSUSE:Leap:15.1:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2020-609 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TUHDFY53Y3VOY7VK7BOC2B4H5HIPQAFJ/ E-Mail link for openSUSE-SU-2020:0609-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1161562 SUSE Bug 1161562 https://bugzilla.suse.com/1161563 SUSE Bug 1161563 https://bugzilla.suse.com/1163532 SUSE Bug 1163532 https://www.suse.com/security/cve/CVE-2019-19274/ SUSE CVE CVE-2019-19274 page https://www.suse.com/security/cve/CVE-2019-19275/ SUSE CVE CVE-2019-19275 page SUSE Package Hub 15 SP1 python3-typed-ast-1.3.1-bp151.2.6.1 python3-typed-ast-1.3.1-bp151.2.6.1 as a component of SUSE Package Hub 15 SP1 typed_ast 1.3.0 and 1.3.1 has a handle_keywordonly_args out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.) CVE-2019-19274 SUSE Package Hub 15 SP1:python3-typed-ast-1.3.1-bp151.2.6.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TUHDFY53Y3VOY7VK7BOC2B4H5HIPQAFJ/ https://www.suse.com/security/cve/CVE-2019-19274.html CVE-2019-19274 https://bugzilla.suse.com/1161562 SUSE Bug 1161562 typed_ast 1.3.0 and 1.3.1 has an ast_for_arguments out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.) CVE-2019-19275 SUSE Package Hub 15 SP1:python3-typed-ast-1.3.1-bp151.2.6.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TUHDFY53Y3VOY7VK7BOC2B4H5HIPQAFJ/ https://www.suse.com/security/cve/CVE-2019-19275.html CVE-2019-19275 https://bugzilla.suse.com/1161563 SUSE Bug 1161563