PT-2021-7477 · Numpy+5 · Numpy+5

Published 2021-05-12 · Updated 2025-01-28 · CVE-2021-34141

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions NumPy versions prior to 1.22.0 NumPy versions 1.9.x

Description The issue is related to an incomplete string comparison in the numpy.core component, which allows attackers to trigger slightly incorrect copying by constructing specific string objects. The vendor states that this reported code behavior is completely harmless. The vulnerability may allow a remote attacker to initiate data copying using specially crafted objects.

Recommendations For NumPy versions prior to 1.22.0, update to version 1.22.0 or later to resolve the issue. For NumPy versions 1.9.x, update to version 1.22.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the numpy.core component until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-697

Related Identifiers

ALT-PU-2022-1119

BDU:2022-06724

CVE-2021-34141

ECHO-4195-024C-0BCD

GHSA-FPFV-JQM9-F5JM

OESA-2022-1522

PYSEC-2021-855

USN-5763-1

Affected Products

Alt Linux

Debian

Linuxmint

Numpy

Red Os

Ubuntu

References · 29

• 🔥 https://github.com/numpy/numpy/issues/18993 · Exploit
• https://osv.dev/vulnerability/USN-5763-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-33430 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-41496 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-41495 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-34141 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-34141 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/cve-2021-34141 · Security Note
• https://ubuntu.com/security/CVE-2021-34141 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fpfv-jqm9-f5jm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34141 · Security Note
• https://ubuntu.com/security/notices/USN-5763-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-34141 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-34141 · Vendor Advisory