Python/numpy/1.20.1
Fundamental package for array computing in Python
https://pypi.org/project/numpy
BSD
2 Security Vulnerabilities
NumPy Buffer Overflow (Disputed)
Published date: 2022-01-07T00:09:39Z
CVE: CVE-2021-33430
Links:
- https://nvd.nist.gov/vuln/detail/CVE-2021-33430
- https://github.com/numpy/numpy/issues/18939
- https://github.com/numpy/numpy/commit/ae317fd9ff3e79c0eac357d723bfc29cbd625f2e
- https://github.com/advisories/GHSA-6p56-wp2h-9hxr
- https://github.com/pypa/advisory-database/tree/main/vulns/numpy/PYSEC-2021-854.yaml
A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArrayNewFromDescrint function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service.
NOTE: The vendor does not agree this is a vulnerability; In (very limited) circumstances a user may be able provoke the buffer overflow, the user is most likely already privileged to at least provoke denial of service by exhausting memory. Triggering this further requires the use of uncommon API (complicated structured dtypes), which is very unlikely to be available to an unprivileged user.
Affected versions: ["1.10.0", "1.13.0rc1", "1.14.0", "1.14.0rc1", "1.16.0", "1.16.6", "1.17.2", "1.18.3", "1.10.1", "1.11.2", "1.12.0", "1.16.2", "1.16.3", "1.17.4", "1.18.0", "1.18.5", "1.19.0rc1", "1.20.1", "1.10.3", "1.11.0", "1.11.3", "1.14.3", "1.14.6", "1.15.0rc2", "1.16.0rc1", "1.16.5", "1.17.0rc2", "1.18.2", "1.19.0rc2", "1.19.1", "1.10.2", "1.12.1", "1.13.3", "1.14.1", "1.15.1", "1.17.3", "1.19.4", "1.9.3", "1.10.4", "1.13.0rc2", "1.14.5", "1.15.0", "1.15.3", "1.15.4", "1.17.1", "1.18.0rc1", "1.18.4", "1.11.1", "1.17.0rc1", "1.19.0", "1.9.1", "1.9.2", "1.13.1", "1.14.4", "1.16.1", "1.16.4", "1.17.0", "1.19.2", "1.19.3", "1.20.2", "1.13.0", "1.14.2", "1.15.0rc1", "1.15.2", "1.16.0rc2", "1.17.5", "1.18.1", "1.19.5", "1.20.0", "1.20.0rc1", "1.20.0rc2", "1.9.0", "1.20.3", "1.21.0rc1", "1.21.0rc2"]
Secure versions: [1.22.0, 1.22.1, 1.22.2, 1.22.3, 1.22.4, 1.23.0, 1.23.0rc1, 1.23.0rc2, 1.23.0rc3, 1.23.1, 1.23.2, 1.23.3, 1.23.4, 1.23.5, 1.24.0, 1.24.0rc1, 1.24.0rc2, 1.24.1, 1.24.2, 1.24.3, 1.24.4, 1.25.0, 1.25.0rc1, 1.25.1, 1.25.2, 1.26.0, 1.26.0b1, 1.26.0rc1, 1.26.1, 1.26.2, 1.26.3, 1.26.4, 2.0.0, 2.0.0b1, 2.0.0rc1, 2.0.0rc2, 2.0.1, 2.0.2, 2.1.0, 2.1.0rc1, 2.1.1, 2.1.2, 2.1.3, 2.2.0, 2.2.0rc1, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.3.0, 2.3.0rc1, 2.3.1, 2.3.2, 2.3.3, 2.3.4, 2.3.5, 2.4.0, 2.4.0rc1, 2.4.1, 2.4.2, 2.4.3, 2.4.4]
Recommendation: Update to version 2.4.4.
Incorrect Comparison in NumPy
Published date: 2021-12-18T00:00:41Z
CVE: CVE-2021-34141
Links:
- https://nvd.nist.gov/vuln/detail/CVE-2021-34141
- https://github.com/numpy/numpy/issues/18993
- https://github.com/advisories/GHSA-fpfv-jqm9-f5jm
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://github.com/numpy/numpy/issues/18993#issuecomment-1010735102
- https://github.com/pypa/advisory-database/tree/main/vulns/numpy/PYSEC-2021-855.yaml
Incomplete string comparison in the numpy.core component in NumPy1.9.x, which allows attackers to fail the APIs via constructing specific string objects.
Affected versions: ["1.10.0", "1.13.0rc1", "1.14.0", "1.14.0rc1", "1.16.0", "1.16.6", "1.17.2", "1.18.3", "1.3.0", "1.4.1", "0.9.8", "1.0", "1.10.1", "1.11.2", "1.12.0", "1.16.2", "1.16.3", "1.17.4", "1.18.0", "1.18.5", "1.19.0rc1", "1.20.1", "1.0.4", "1.10.3", "1.11.0", "1.11.3", "1.14.3", "1.14.6", "1.15.0rc2", "1.16.0rc1", "1.16.5", "1.17.0rc2", "1.18.2", "1.19.0rc2", "1.19.1", "1.5.1", "1.6.0", "1.0b4", "1.10.2", "1.12.1", "1.13.3", "1.14.1", "1.15.1", "1.17.3", "1.19.4", "1.8.0", "1.9.3", "0.9.6", "1.0b5", "1.0rc3", "1.10.4", "1.13.0rc2", "1.14.5", "1.15.0", "1.15.3", "1.15.4", "1.17.1", "1.18.0rc1", "1.18.4", "1.4.0", "1.11.1", "1.17.0rc1", "1.19.0", "1.7.0", "1.7.1", "1.8.1", "1.9.1", "1.9.2", "1.0b1", "1.13.1", "1.14.4", "1.16.1", "1.16.4", "1.17.0", "1.19.2", "1.19.3", "1.2.1", "1.20.2", "1.5.0", "1.6.1", "1.7.2", "1.0.3", "1.0rc1", "1.0rc2", "1.1.1", "1.13.0", "1.14.2", "1.15.0rc1", "1.15.2", "1.16.0rc2", "1.17.5", "1.18.1", "1.19.5", "1.2.0", "1.20.0", "1.20.0rc1", "1.20.0rc2", "1.6.2", "1.8.2", "1.9.0", "1.20.3", "1.21.0rc1", "1.21.0rc2", "1.21.0", "1.21.1", "1.21.2", "1.21.3", "1.21.4", "1.22.0rc1", "1.22.0rc2", "1.21.5", "1.22.0rc3", "1.21.6"]
Secure versions: [1.22.0, 1.22.1, 1.22.2, 1.22.3, 1.22.4, 1.23.0, 1.23.0rc1, 1.23.0rc2, 1.23.0rc3, 1.23.1, 1.23.2, 1.23.3, 1.23.4, 1.23.5, 1.24.0, 1.24.0rc1, 1.24.0rc2, 1.24.1, 1.24.2, 1.24.3, 1.24.4, 1.25.0, 1.25.0rc1, 1.25.1, 1.25.2, 1.26.0, 1.26.0b1, 1.26.0rc1, 1.26.1, 1.26.2, 1.26.3, 1.26.4, 2.0.0, 2.0.0b1, 2.0.0rc1, 2.0.0rc2, 2.0.1, 2.0.2, 2.1.0, 2.1.0rc1, 2.1.1, 2.1.2, 2.1.3, 2.2.0, 2.2.0rc1, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.3.0, 2.3.0rc1, 2.3.1, 2.3.2, 2.3.3, 2.3.4, 2.3.5, 2.4.0, 2.4.0rc1, 2.4.1, 2.4.2, 2.4.3, 2.4.4]
Recommendation: Update to version 2.4.4.
177 Other Versions
| Version | License | Security | Released | |
|---|---|---|---|---|
| 1.8.1 | BSD | 5 | 2016-04-20 - 04:22 | almost 10 years |
| 1.8.0 | BSD | 7 | 2016-04-20 - 04:25 | almost 10 years |
| 1.7.2 | BSD | 7 | 2016-04-20 - 03:54 | almost 10 years |
| 1.7.1 | BSD | 7 | 2016-04-20 - 04:28 | almost 10 years |
| 1.7.0 | BSD | 7 | 2016-04-20 - 04:30 | almost 10 years |
| 1.6.2 | BSD | 7 | 2016-04-20 - 03:56 | almost 10 years |
| 1.6.1 | BSD | 7 | 2016-04-20 - 04:32 | almost 10 years |
| 1.6.0 | BSD | 7 | 2016-04-20 - 04:34 | almost 10 years |
| 1.5.1 | BSD | 7 | 2014-07-30 - 22:27 | over 11 years |
| 1.5.0 | BSD | 7 | 2010-09-15 - 14:44 | over 15 years |
| 1.4.1 | BSD | 7 | 2010-04-24 - 16:30 | almost 16 years |
| 1.4.0 | BSD | 7 | 1970-01-01 - 00:00 | over 56 years |
| 1.3.0 | BSD | 7 | 2009-04-06 - 06:19 | about 17 years |
| 1.2.1 | BSD | 7 | 1970-01-01 - 00:00 | over 56 years |
| 1.2.0 | BSD | 7 | 1970-01-01 - 00:00 | over 56 years |
| 1.1.1 | BSD | 7 | 1970-01-01 - 00:00 | over 56 years |
| 1.0.4 | BSD | 7 | 1970-01-01 - 00:00 | over 56 years |
| 1.0.3 | BSD | 7 | 1970-01-01 - 00:00 | over 56 years |
| 1.0 | BSD | 7 | 2006-12-02 - 02:07 | over 19 years |
| 0.9.8 | BSD | 7 | 1970-01-01 - 00:00 | over 56 years |
| 0.9.6 | BSD | 7 | 1970-01-01 - 00:00 | over 56 years |
| 1.0b4 | BSD | 7 | 1970-01-01 - 00:00 | over 56 years |
| 1.0b5 | BSD | 7 | 1970-01-01 - 00:00 | over 56 years |
| 1.0rc3 | BSD | 7 | 1970-01-01 - 00:00 | over 56 years |
| 1.0b1 | BSD | 7 | 1970-01-01 - 00:00 | over 56 years |
| 1.0rc1 | BSD | 7 | 1970-01-01 - 00:00 | over 56 years |
| 1.0rc2 | BSD | 7 | 1970-01-01 - 00:00 | over 56 years |