PT-2021-20138 · Numpy+4 · Numpy+4

Awen-Lio · Published 2021-12-17 · Updated 2026-01-23 · CVE-2021-33430

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Medium

Base vector

AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions NumPy version 1.9.x

Description A Buffer Overflow issue exists in the PyArray NewFromDescr int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service. The vendor does not agree this is an issue; in very limited circumstances, a user may be able to provoke the buffer overflow, and the user is most likely already privileged to at least provoke denial of service by exhausting memory. Triggering this further requires the use of uncommon API (complicated structured dtypes), which is very unlikely to be available to an unprivileged user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2021-33430

GHSA-6P56-WP2H-9HXR

MGASA-2022-0032

OPENSUSE-SU-2022:0134-1

OPENSUSE-SU-2022:1064-1

OPENSUSE-SU-2022_0134-1

OPENSUSE-SU-2022_1064-1

OPENSUSE-SU-2022_1064-2

OPENSUSE-SU-2024:11747-1

OPENSUSE-SU-2024:13220-1

OPENSUSE-SU-2024:14311-1

OPENSUSE-SU-2025:14743-1

PYSEC-2021-854

RHSA-2022:0987

RHSA-2022:1000

SUSE-SU-2022:0118-1

SUSE-SU-2022:0134-1

SUSE-SU-2022:0134-2

SUSE-SU-2022:0134-3

SUSE-SU-2022:0206-1

SUSE-SU-2022:1064-1

SUSE-SU-2022:1064-2

SUSE-SU-2022:2441-1

SUSE-SU-2022_0118-1

SUSE-SU-2022_0134-1

SUSE-SU-2022_0134-3

SUSE-SU-2022_0206-1

SUSE-SU-2022_1064-1

SUSE-SU-2022_1064-2

SUSE-SU-2022_2441-1

USN-5763-1

Affected Products

Debian

Linuxmint

Numpy

Suse

Ubuntu

References · 59

• 🔥 https://github.com/numpy/numpy/issues/18939 · Exploit
• https://ubuntu.com/security/CVE-2021-41495 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-33430 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:1064-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:0134-2 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0032 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-34141 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-33430 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:0134-3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33430 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14743-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0032.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-33430 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-33430 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:1064-1 · Vendor Advisory