GHSA-frgw-fgh6-9g52 CVE-2017-12852 PYSEC-2017-1
Numpy missing input validation
- Severity
- 7.5 / 10
- High · CVSS 3.0
- Exploit chance (EPSS)
- 2.74%
- Chance of exploitation in the next 30 days. Higher than 86.13% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
- Fix
1.13.3- Upgrade numpy to this version or later
Description
The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.
Affected versions
PyPI
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
numpy PyPI → 1.13.3
- pip
pip install --upgrade "numpy>=1.13.3"- poetry
poetry add "numpy>=1.13.3"- uv
uv add "numpy>=1.13.3"
Severity breakdown
CVSS 3.0 7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-f7c7-j99h-c22f Buffer Copy without Checking Size of Input in NumPy | Medium | Also affects numpy |
| GHSA-5545-2q6w-2gh6 NumPy NULL Pointer Dereference | High | Also affects numpy |
| GHSA-fpfv-jqm9-f5jm Incorrect Comparison in NumPy | Medium | Also affects numpy |
| GHSA-6p56-wp2h-9hxr NumPy Buffer Overflow (Disputed) | Medium | Also affects numpy |
| GHSA-9fq2-x9r6-wfmf Numpy Deserialization of Untrusted Data | Critical | Also affects numpy |
| GHSA-cw6w-4rcx-xphc Arbitrary file write in NumPy | Medium | Also affects numpy |
| GHSA-2fc2-6r4j-p65h Numpy arbitrary file write via symlink attack | Medium | Also affects numpy |
| GHSA-5849-834g-hvw5 pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search | High | Same weakness, CWE-835 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor