aswin1906/github-advisory-2019.csv huggingface dataset:
Possible Information Leak / Session Hijack Vulnerability in Rack
Advisory: GHSA-hrqr-hxpp-chr3
Aliases: CVE-2019-16782
Published: 2019-12-18T19:01:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected: package: ecosystem: RubyGems
name: rack
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.6.12
package: ecosystem: RubyGems
name: rack
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 2.0.8
cwe_ids: CWE-203
CWE-208
severity: MODERATE

There's a possible information leak / session hijack vulnerability in Rack. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session.

The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.

### Impact

The session id stored in a cookie is the same id that is used when querying the backing session storage engine.  Most storage mechanisms (for example a database) use some sort of indexing in order to speed up the lookup of that id.  By carefully timing requests and session lookup failures, an attacker may be able to perform a timing attack to determine an existing session id and hijack that session.

## Releases

The 1.6.12 and 2.0.8 releases are available at the normal locations.

### Workarounds

There are no known workarounds.

### Patches

To aid users who aren't able to upgrade immediately we have provided patches for
the two supported release series. They are in git-am format and consist of a
single changeset.

* 1-6-session-timing-attack.patch - Patch for 1.6 series
* 2-0-session-timing-attack.patch - Patch for 2.6 series

### Credits

Thanks Will Leinweber for reporting this!
HTTP Request Smuggling: Invalid whitespace characters in headers in Waitress
Advisory: GHSA-m5ff-3wj3-8ph4
Published: 2019-12-26T16:34:38Z
Affected: package: ecosystem: PyPI
name: waitress
ecosystem_specific: affected_functions: waitress.parser.HTTPRequestParser.parse_header
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.4.1
cwe_ids: CWE-444
severity: HIGH

### Impact

If a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling.

```
Content-Length: 10
Transfer-Encoding: [\x0b]chunked
```

For clarity:

```
0x0b == vertical tab
```

Would get parsed by Waitress as being a `chunked` request, but a front-end server would use the `Content-Length` instead as the `Transfer-Encoding` header is considered invalid due to containing invalid characters.

If a front-end server does HTTP pipelining to a backend Waitress server this could lead to HTTP request splitting which may lead to potential cache poisoning or unexpected information disclosure.

### Patches

Please upgrade to Waitress 1.4.1 which fixes this issue with stricter HTTP field validation.

Waitress 1.4.1 due to this change has become much more strict in what is allowed in header values, while the maintainers don't believe that these changes will cause any issues, it may cause failures with non-conformist reverse proxies or clients, and it is highly recommend that users validate the changes in their environment and make sure it won't cause any unacceptable failures.

### Workarounds

You may enable additional protections on front-end servers, those that follow RFC7230 correctly would drop the request with a 400 Bad Request.

Waitress will now correctly responds to the request with a 400 Bad Request, and will drop the connection to avoid any potential HTTP pipelining issues.

### References

This was mentioned in https://portswigger.net/research/http-desync-attacks-what-happened-next and was specifically mentioned as being an issue in HAProxy which did not properly filter it in this article: https://nathandavison.com/blog/haproxy-http-request-smuggling

### Thanks

The Pylons Project would like to thank ZeddYu Lu for doing extended testing against Waitress 1.4.0 and bringing this to our attention!

### For more information

If you have any questions or comments about this advisory:

* open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related)
* email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)
Data leakage via SQL Injection in Pimcore
Advisory: GHSA-fpff-384j-vxq7
Aliases: CVE-2019-10763
Published: 2019-12-02T18:05:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: Packagist
name: pimcore/pimcore
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 6.3.0
cwe_ids: CWE-89
severity: MODERATE

pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. An attacker with limited privileges (classes permission) can achieve a SQL injection that can lead in data leakage. The vulnerability can be exploited via 'id', 'storeId', 'pageSize' and 'tables' parameters, using a payload for trigger a time based or error based sql injection.
Drupal core third-party PEAR Archive_Tar library is vulnerable to Deserialization of Untrusted Data
Advisory: GHSA-6rmq-x2hv-vxpp
Aliases: CVE-2019-6338
Published: 2019-12-02T18:11:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Packagist
name: drupal/drupal
ranges: type: ECOSYSTEM
events: introduced: 7.0.0
fixed: 7.62.0
package: ecosystem: Packagist
name: drupal/drupal
ranges: type: ECOSYSTEM
events: introduced: 8.0.0
fixed: 8.5.9
package: ecosystem: Packagist
name: drupal/drupal
ranges: type: ECOSYSTEM
events: introduced: 8.6.0
fixed: 8.6.6
cwe_ids: CWE-502
severity: HIGH

In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details
User enumeration leak using switch user functionality in Symfony
Advisory: GHSA-4vpc-5jx4-cfqg
Aliases: CVE-2019-18886
Published: 2019-12-02T18:09:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: package: ecosystem: Packagist
name: symfony/security-http
ranges: type: ECOSYSTEM
events: introduced: 4.1.0
fixed: 4.2.12
package: ecosystem: Packagist
name: symfony/security-http
ranges: type: ECOSYSTEM
events: introduced: 4.3.0
fixed: 4.3.8
package: ecosystem: Packagist
name: symfony/symfony
ranges: type: ECOSYSTEM
events: introduced: 4.1.0
fixed: 4.2.12
package: ecosystem: Packagist
name: symfony/symfony
ranges: type: ECOSYSTEM
events: introduced: 4.3.0
fixed: 4.3.8
cwe_ids: CWE-200
CWE-203
severity: MODERATE

An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0 to 4.3.7. The ability to enumerate users was possible due to different handling depending on whether the user existed when making unauthorized attempts to use the switch users functionality. This is related to symfony/security.
HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress
Advisory: GHSA-g2xc-35jw-c63p
Aliases: CVE-2019-16786
Published: 2019-12-20T23:04:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Affected: package: ecosystem: PyPI
name: waitress
ecosystem_specific: affected_functions: waitress.parser.HTTPRequestParser.received
waitress.parser.HTTPRequestParser.parse_header
waitress.parser.get_header_lines
waitress.receiver.ChunkedReceiver
waitress.receiver.ChunkedReceiver.received
waitress.utilities.find_double_newline
waitress.utilities.Error
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.4.0
cwe_ids: CWE-444
severity: HIGH

### Impact

Waitress would parse the `Transfer-Encoding` header and only look for a single string value, if that value was not `chunked` it would fall through and use the `Content-Length` header instead.

According to the HTTP standard `Transfer-Encoding` should be a comma separated list, with the inner-most encoding first, followed by any further transfer codings, ending with `chunked`.

Requests sent with:

```
Transfer-Encoding: gzip, chunked
```

Would incorrectly get ignored, and the request would use a `Content-Length` header instead to determine the body size of the HTTP message.

This could allow for Waitress to treat a single request as multiple requests in the case of HTTP pipelining.

### Patches

This issue is fixed in Waitress 1.4.0. This brings a range of changes to harden Waitress against potential HTTP request confusions, and may change the behaviour of Waitress behind non-conformist proxies. 

Waitress will now return a 501 Not Implemented error if the `Transfer-Encoding` is not `chunked` or contains multiple elements. Waitress does not support any transfer codings such as `gzip` or `deflate`.

The Pylons Project recommends upgrading as soon as possible, while validating that the changes in Waitress don&#39;t cause any changes in behavior.

### Workarounds

Various reverse proxies may have protections against sending potentially bad HTTP requests to the backend, and or hardening against potential issues like this. If the reverse proxy doesn&#39;t use HTTP/1.1 for connecting to the backend issues are also somewhat mitigated, as HTTP pipelining does not exist in HTTP/1.0 and Waitress will close the connection after every single request (unless the Keep Alive header is explicitly sent... so this is not a fool proof security method).

### Issues/more security issues:

* open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related)
* email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)
Cross-Site Scripting in serialize-javascript
Advisory: GHSA-h9rv-jmmf-4pgx
Aliases: CVE-2019-16769
Published: 2019-12-05T18:44:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Affected: package: ecosystem: npm
name: serialize-javascript
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.1.1
cwe_ids: CWE-79
severity: MODERATE

Versions of `serialize-javascript` prior to 2.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize serialized regular expressions. This vulnerability does not affect Node.js applications.


## Recommendation

Upgrade to version 2.1.1 or later.
Cross-Site Scripting in iobroker.web
Advisory: GHSA-6rjc-4pwr-3vp7
Aliases: CVE-2019-10771
Published: 2019-12-02T18:14:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: iobroker.web
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.4.10
cwe_ids: CWE-79
severity: MODERATE

Versions of `iobroker.web` prior to 2.4.10 are vulnerable to Cross-Site Scripting. The package fails to escape URL parameters that may be reflected in the server response. This can be used by attackers to execute arbitrary JavaScript in the victim's browser.


## Recommendation

Upgrade to version 2.4.10 or later.
In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation attack
Advisory: GHSA-9xcj-c8cr-8c3c
Aliases: CVE-2019-17563
Published: 2019-12-26T18:22:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: org.apache.tomcat.embed:tomcat-embed-core
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 7.0.99
package: ecosystem: Maven
name: org.apache.tomcat.embed:tomcat-embed-core
ranges: type: ECOSYSTEM
events: introduced: 8.0.0
fixed: 8.5.50
package: ecosystem: Maven
name: org.apache.tomcat.embed:tomcat-embed-core
ranges: type: ECOSYSTEM
events: introduced: 9.0.0
fixed: 9.0.30
cwe_ids: CWE-384
severity: HIGH

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.
HTTP Request Smuggling: Content-Length Sent Twice in Waitress
Advisory: GHSA-4ppp-gpcr-7qf6
Published: 2019-12-20T23:04:35Z
Affected: package: ecosystem: PyPI
name: waitress
ecosystem_specific: affected_functions: waitress.parser.HTTPRequestParser.parse_header
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.4.0
cwe_ids: CWE-444
severity: CRITICAL

### Impact

Waitress would header fold a double `Content-Length` header and due to being unable to cast the now comma separated value to an integer would set the `Content-Length` to 0 internally.

So a request with:

```
Content-Length: 10
Content-Length: 10
```

would get transformed to:

```
Content-Length: 10, 10
```

Which would Waitress would then internally set to `Content-Lenght: 0`.

Waitress would then treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining.

### Patches

This issue is fixed in Waitress 1.4.0. This brings a range of changes to harden Waitress against potential HTTP request confusions, and may change the behaviour of Waitress behind non-conformist proxies. 

The Pylons Project recommends upgrading as soon as possible, while validating that the changes in Waitress don't cause any changes in behavior.

### Workarounds

Various reverse proxies may have protections against sending potentially bad HTTP requests to the backend, and or hardening against potential issues like this. If the reverse proxy doesn't use HTTP/1.1 for connecting to the backend issues are also somewhat mitigated, as HTTP pipelining does not exist in HTTP/1.0 and Waitress will close the connection after every single request (unless the Keep Alive header is explicitly sent... so this is not a fool proof security method).

### Issues/more security issues:

* open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related)
* email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)
Arbitrary File Write in iobroker.js-controller
Advisory: GHSA-cmch-296j-wfvw
Aliases: CVE-2019-10767
Published: 2019-12-02T18:06:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: npm
name: iobroker.js-controller
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.0.25
cwe_ids: CWE-22
severity: HIGH

Versions of `iobroker.controller` prior to 2.0.25 are vulnerable to Path Traversal. The package fails to restrict access to folders outside of the intended `/adapter/<adapter-name>` folder, which may allow attackers to include arbitrary files in the system. An attacker would need to be authenticated to perform the attack but the package has authentication disabled by default.


## Recommendation

Upgrade to version 2.0.25 or later.
Apache NiFi process group information disclosure
Advisory: GHSA-26p8-xrj2-mv53
Aliases: CVE-2019-10083
Published: 2019-12-02T18:18:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: package: ecosystem: Maven
name: org.apache.nifi:nifi-web-api
ranges: type: ECOSYSTEM
events: introduced: 1.3.0
fixed: 1.10.0
package: ecosystem: Maven
name: org.apache.nifi:nifi
ranges: type: ECOSYSTEM
events: introduced: 1.3.0
fixed: 1.10.0
cwe_ids: CWE-200
severity: MODERATE

When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the top most level, not recursively). The response included details about processors and controller services which the user may not have had read access to.
Remote Code Execution Vulnerability in NPM mongo-express
Advisory: GHSA-h47j-hc6x-h3qq
Aliases: CVE-2019-10758
Published: 2019-12-30T19:30:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: mongo-express
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.54.0
cwe_ids: CWE-78
severity: CRITICAL

### Impact

Remote code execution on the host machine by any authenticated user.

### Proof Of Concept

Launching mongo-express on a Mac, pasting the following into the "create index" field will pop open the Mac calculator:

```javascript
this.constructor.constructor("return process")().mainModule.require('child_process').execSync('/Applications/Calculator.app/Contents/MacOS/Calculator')
```

### Patches
Users should upgrade to version `0.54.0`

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

### References
[Snyk Security Advisory](https://snyk.io/vuln/SNYK-JS-MONGOEXPRESS-473215)
[CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10758)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [example link to repo](http://example.com)
* Email us at [example email address](mailto:example@example.com)

#### Thanks

@JLLeitschuh for finding and reporting this vulnerability
typed-ast Out-of-bounds Read
Advisory: GHSA-7xxv-wpxj-mx5v
Aliases: CVE-2019-19275
Published: 2019-12-02T18:03:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: PyPI
name: typed-ast
ranges: type: ECOSYSTEM
events: introduced: 1.3.0
fixed: 1.4.0
database_specific: last_known_affected_version_range: <= 1.3.1
cwe_ids: CWE-125
severity: HIGH

typed_ast 1.3.0 and 1.3.1 has an ast_for_arguments out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.)
Pomelo allows external control of critical state data
Advisory: GHSA-4x6v-rwh4-55jw
Aliases: CVE-2019-18954
Published: 2019-12-02T18:16:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: package: ecosystem: npm
name: pomelo
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.2.7
cwe_ids: CWE-668
severity: MODERATE

Pomelo v2.2.5 allows external control of critical state data. A malicious user input can corrupt arbitrary methods and attributes in `template/game-server/app/servers/connector/handler/entryHandler.js` because certain internal attributes can be overwritten via a conflicting name. Hence, a malicious attacker can manipulate internal attributes by adding additional attributes to user input.
Insufficiently Protected Credentials in Apache Tomcat
Advisory: GHSA-hh3j-x4mc-g48r
Aliases: CVE-2019-12418
Published: 2019-12-26T18:22:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: org.apache.tomcat.embed:tomcat-embed-core
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 7.0.99
database_specific: last_known_affected_version_range: < 7.0.98
package: ecosystem: Maven
name: org.apache.tomcat.embed:tomcat-embed-core
ranges: type: ECOSYSTEM
events: introduced: 8.0.0
fixed: 8.5.49
database_specific: last_known_affected_version_range: < 8.5.48
package: ecosystem: Maven
name: org.apache.tomcat.embed:tomcat-embed-core
ranges: type: ECOSYSTEM
events: introduced: 9.0.0
fixed: 9.0.29
cwe_ids: CWE-522
severity: HIGH

When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') in Armeria
Advisory: GHSA-35fr-h7jr-hh86
Published: 2019-12-06T18:55:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: com.linecorp.armeria:armeria
ranges: type: ECOSYSTEM
events: introduced: 0.85.0
fixed: 0.97.0
cwe_ids: CWE-113
CWE-74
severity: MODERATE

Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject arbitrary HTTP headers via CRLF sequences when unsanitized data is used to populate the headers of an HTTP response.

### Impact

1. Cross-User Defacement
2. Cache Poisoning
3. Cross-Site Scripting (XSS)
4. Page Hijacking


### Root Cause

The root cause is due to the usage of Netty without the HTTP header validation.

https://github.com/line/armeria/blob/f0d870fde1088114070be31b67f7df0a21e835c6/core/src/main/java/com/linecorp/armeria/common/DefaultHttpHeaders.java#L23

### Patches

This vulnerability has been patched in 0.97.0.

### References

[CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')](https://cwe.mitre.org/data/definitions/113.html)
https://github.com/ratpack/ratpack/security/advisories/GHSA-mvqp-q37c-wf9j

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [GitHub](https://github.com/line/armeria/issues)
Unescaped exception messages in error responses in Jetty
Advisory: GHSA-5h9j-q6j2-253f
Aliases: CVE-2019-17632
Published: 2019-12-02T18:13:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: org.eclipse.jetty:jetty-server
ranges: type: ECOSYSTEM
events: introduced: 9.4.21.v20190926
fixed: 9.4.24.v20191120
versions: 9.4.21.v20190926
package: ecosystem: Maven
name: org.eclipse.jetty:jetty-server
ranges: type: ECOSYSTEM
events: introduced: 9.4.22.v20191022
fixed: 9.4.24.v20191120
versions: 9.4.22.v20191022
package: ecosystem: Maven
name: org.eclipse.jetty:jetty-server
ranges: type: ECOSYSTEM
events: introduced: 9.4.23.v20191118
fixed: 9.4.24.v20191120
versions: 9.4.23.v20191118
cwe_ids: CWE-79
severity: MODERATE

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.
lodahs is malware
Advisory: GHSA-hm6q-r2jc-cpqh
Aliases: CVE-2019-19771
Published: 2019-12-16T19:29:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: lodahs
ranges: type: ECOSYSTEM
events: 0.0.1
cwe_ids: CWE-506
severity: HIGH

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
typed-ast Out-of-bounds Read
Advisory: GHSA-m3jw-62m7-jjcm
Aliases: CVE-2019-19274
Published: 2019-12-02T18:02:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: PyPI
name: typed-ast
ranges: type: ECOSYSTEM
events: introduced: 1.3.0
fixed: 1.4.0
database_specific: last_known_affected_version_range: <= 1.3.1
cwe_ids: CWE-125
severity: HIGH

typed_ast 1.3.0 and 1.3.1 has a handle_keywordonly_args out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.)