PT-2021-8282 · Numpy+5 · Numpy+5
Published
2021-12-17
·
Updated
2025-01-28
·
CVE-2021-41496
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
NumPy versions prior to 1.19
Description
The issue is related to a buffer overflow in the
array from pyobj function of fortranobject.c in NumPy, which can be exploited to conduct Denial of Service attacks by carefully constructing an array with negative values. Note that the vendor does not agree this is a vulnerability, as the negative dimensions can only be created by an already privileged user or internally.Recommendations
For NumPy versions prior to 1.19, consider disabling the
array from pyobj function as a temporary workaround until a patch is available. Restrict access to the fortranobject.c module to minimize the risk of exploitation. Avoid using negative values in arrays to prevent potential Denial of Service attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
DoS
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linuxmint
Numpy
Red Os
Suse
Ubuntu