PYSEC-2019-38
** DISPUTED ** An issue was discovered in NumPy 1.16.0 and earlier.
- Severity
- Not rated yet
- No source has published a CVSS score yet
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
1.16.1- Upgrade numpy to this version or later
Description
** DISPUTED ** An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior that might have legitimate applications in (for example) loading serialized Python object arrays from trusted and authenticated sources.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| numpy | < 1.16.1 |
1.16.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
numpy PyPI → 1.16.1
- pip
pip install --upgrade "numpy>=1.16.1"- poetry
poetry add "numpy>=1.16.1"- uv
uv add "numpy>=1.16.1"
References
Other links
- github.com/numpy/numpy/issues/12759
- bugzilla.suse.com/show_bug.cgi
- securityfocus.com/bid/106670
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ZZAY…
- lists.opensuse.org/opensuse-security-announce/2019-09/msg00091.html
- lists.opensuse.org/opensuse-security-announce/2019-09/msg00092.html
- lists.opensuse.org/opensuse-security-announce/2019-10/msg00015.html
- access.redhat.com/errata/RHSA-2019:3335
- access.redhat.com/errata/RHSA-2019:3704
Timeline
- Published
- Last updated by the source
- Withdrawn
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-f7c7-j99h-c22f Buffer Copy without Checking Size of Input in NumPy | Medium | Also affects numpy |
| GHSA-5545-2q6w-2gh6 NumPy NULL Pointer Dereference | High | Also affects numpy |
| GHSA-fpfv-jqm9-f5jm Incorrect Comparison in NumPy | Medium | Also affects numpy |
| GHSA-6p56-wp2h-9hxr NumPy Buffer Overflow (Disputed) | Medium | Also affects numpy |
| GHSA-9fq2-x9r6-wfmf Numpy Deserialization of Untrusted Data | Critical | Also affects numpy |
| GHSA-cw6w-4rcx-xphc Arbitrary file write in NumPy | Medium | Also affects numpy |
| GHSA-2fc2-6r4j-p65h Numpy arbitrary file write via symlink attack | Medium | Also affects numpy |
| GHSA-frgw-fgh6-9g52 Numpy missing input validation | High | Also affects numpy |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor