pysec-2021-856
Vulnerability from pysec
Published
2021-12-17 20:15
Modified
2021-12-22 21:28
Details
Null Pointer Dereference vulnerability exists in numpy.sort in NumPy < and 1.19 in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays.
Aliases
{ "affected": [ { "package": { "ecosystem": "PyPI", "name": "numpy", "purl": "pkg:pypi/numpy" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "1.19.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "0.9.6", "0.9.8", "1.0", "1.0.3", "1.0.4", "1.0b1", "1.0b4", "1.0b5", "1.0rc1", "1.0rc2", "1.0rc3", "1.1.1", "1.10.0", "1.10.1", "1.10.2", "1.10.3", "1.10.4", "1.11.0", "1.11.1", "1.11.2", "1.11.3", "1.12.0", "1.12.1", "1.13.0", "1.13.0rc1", "1.13.0rc2", "1.13.1", "1.13.3", "1.14.0", "1.14.0rc1", "1.14.1", "1.14.2", "1.14.3", "1.14.4", "1.14.5", "1.14.6", "1.15.0", "1.15.0rc1", "1.15.0rc2", "1.15.1", "1.15.2", "1.15.3", "1.15.4", "1.16.0", "1.16.0rc1", "1.16.0rc2", "1.16.1", "1.16.2", "1.16.3", "1.16.4", "1.16.5", "1.16.6", "1.17.0", "1.17.0rc1", "1.17.0rc2", "1.17.1", "1.17.2", "1.17.3", "1.17.4", "1.17.5", "1.18.0", "1.18.0rc1", "1.18.1", "1.18.2", "1.18.3", "1.18.4", "1.18.5", "1.19.0", "1.19.0rc1", "1.19.0rc2", "1.2.0", "1.2.1", "1.3.0", "1.4.0", "1.4.1", "1.5.0", "1.5.1", "1.6.0", "1.6.1", "1.6.2", "1.7.0", "1.7.1", "1.7.2", "1.8.0", "1.8.1", "1.8.2", "1.9.0", "1.9.1", "1.9.2", "1.9.3" ] } ], "aliases": [ "CVE-2021-41495", "GHSA-5545-2q6w-2gh6" ], "details": "Null Pointer Dereference vulnerability exists in numpy.sort in NumPy \u0026lt and 1.19 in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays.", "id": "PYSEC-2021-856", "modified": "2021-12-22T21:28:25.939120Z", "published": "2021-12-17T20:15:00Z", "references": [ { "type": "REPORT", "url": "https://github.com/numpy/numpy/issues/19038" }, { "type": "ADVISORY", "url": "https://github.com/advisories/GHSA-5545-2q6w-2gh6" } ] }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.