PT-2021-7918 · Numpy+5 · Numpy+5
Published
2021-12-17
·
Updated
2025-02-11
·
CVE-2021-41495
CVSS v2.0
6.3
Medium
| Vector | AV:N/AC:M/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
NumPy versions prior to 1.19
Description
The issue is related to a Null Pointer Dereference vulnerability in the
numpy.sort component of NumPy, specifically in the PyArray DescrNew function due to missing return-value validation. This allows attackers to conduct DoS attacks by repetitively creating and sorting arrays, potentially leading to memory exhaustion. However, it's noted that if a user can exhaust memory, they are already privileged, and constructing an attack to target memory exhaustion at exactly this point is practically impossible.Recommendations
For NumPy versions prior to 1.19, consider updating to a version that includes the fix for this issue, as the current version may allow for DoS attacks due to the Null Pointer Dereference vulnerability in the
numpy.sort component.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
DoS
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linuxmint
Numpy
Red Os
Suse
Ubuntu