GHSA-2fc2-6r4j-p65h CVE-2014-1859 PYSEC-2018-34
Numpy arbitrary file write via symlink attack
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.47%
- Chance of exploitation in the next 30 days. Higher than 40.71% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-59 Improper Link Resolution Before File Access ('Link Following')
- Fix
1.8.1- Upgrade numpy to this version or later
Description
(1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file.
Affected versions
PyPI
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
numpy PyPI → 1.8.1
- pip
pip install --upgrade "numpy>=1.8.1"- poetry
poetry add "numpy>=1.8.1"- uv
uv add "numpy>=1.8.1"
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- Low
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.0 5.5
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-59: Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
How to prevent it
- Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
References
Advisories
Packages
Other links
- github.com/numpy/numpy/pull/4262
- github.com/numpy/numpy/commit/0bb46c1448b0d3f5453d5182a17ea7ac5854ee15
- bugs.debian.org/cgi-bin/bugreport.cgi
- bugzilla.redhat.com/show_bug.cgi
- exchange.xforce.ibmcloud.com/vulnerabilities/91317
- github.com/numpy/numpy/blob/maintenance/1.8.x/doc/release/1.8.1-notes.rst
- github.com/pypa/advisory-database/tree/main/vulns/numpy/PYSEC-2018-34.yaml
- web.archive.org/web/20200228165750/http://www.securityfocus.com/bid/65440
- lists.fedoraproject.org/pipermail/package-announce/2014-February/128358.html
- lists.fedoraproject.org/pipermail/package-announce/2014-February/128781.html
- openwall.com/lists/oss-security/2014/02/08/3
- securityfocus.com/bid/65440
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-f7c7-j99h-c22f Buffer Copy without Checking Size of Input in NumPy | Medium | Also affects numpy |
| GHSA-5545-2q6w-2gh6 NumPy NULL Pointer Dereference | High | Also affects numpy |
| GHSA-fpfv-jqm9-f5jm Incorrect Comparison in NumPy | Medium | Also affects numpy |
| GHSA-6p56-wp2h-9hxr NumPy Buffer Overflow (Disputed) | Medium | Also affects numpy |
| GHSA-9fq2-x9r6-wfmf Numpy Deserialization of Untrusted Data | Critical | Also affects numpy |
| GHSA-cw6w-4rcx-xphc Arbitrary file write in NumPy | Medium | Also affects numpy |
| GHSA-frgw-fgh6-9g52 Numpy missing input validation | High | Also affects numpy |
| GHSA-hjqx-j4rw-g7xv zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. | High | Same weakness, CWE-59 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor