OESA-2022-1522

Dashboard / Vulnerabilities / OESA-2022-1522

OESA-2022-1522

Summary: numpy security update

Details: A fast multidimensional array facility for Python. Security Fix(es): Null Pointer Dereference vulnerability exists in numpy.sort in NumPy &lt and 1.19 in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays.(CVE-2021-41495) An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."(CVE-2021-34141)

References: https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1522, https://nvd.nist.gov/vuln/detail/CVE-2021-41495, https://nvd.nist.gov/vuln/detail/CVE-2021-34141