openSUSE-SU-2019:0245-1

    Dashboard / Vulnerabilities / openSUSE-SU-2019:0245-1

    openSUSE-SU-2019:0245-1

    Published: 23 Mar 2019Last Modified: 4 Feb 2026
    Upstream:
    CVE-2019-6446
    Aliases:
    CVE-2019-6446

    Summary: Security update for python-numpy

    Details: This update for python-numpy fixes the following issue: Security issue fixed: - CVE-2019-6446: Set allow_pickle to false by default to restrict loading untrusted content (bsc#1122208). With this update we decrease the possibility of allowing remote attackers to execute arbitrary code by misusing numpy.load(). A warning during runtime will show-up when the allow_pickle is not explicitly set. NOTE: By applying this update the behavior of python-numpy changes, which might break your application. In order to get the old behaviour back, you have to explicitly set `allow_pickle` to True. Be aware that this should only be done for trusted input, as loading untrusted input might lead to arbitrary code execution. This update was imported from the SUSE:SLE-15:Update update project.

    References: https://lists.opensuse.org/archives/list/[email protected]/thread/G6ZDQC6NFUWO7RGAUIZY3TLFQISBKUMX/#G6ZDQC6NFUWO7RGAUIZY3TLFQISBKUMX, https://bugzilla.suse.com/1122208, https://www.suse.com/security/cve/CVE-2019-6446

    Affected packages

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High