Buffer overflow in Numpy - CVE-2021-41496

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU61601

Buffer overflow in Numpy - CVE-2021-41496

Published: March 24, 2022


Vulnerability identifier: #VU61601
CSH Severity: Low
CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-41496
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the array_from_pyobj() function in fortranobject.c. A remote user can pass an array with negative values to the application and perform a denial of service (DoS) attack.


Affected software

Numpy
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Module for HPC
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Python2
SUSE Linux Enterprise Module for Basesystem
openSUSE Leap
openEuler
Ubuntu
Red Hat OpenStack for IBM Power
Red Hat OpenStack
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Red Hat OpenStack Director Deployment Tools
python-numpy-debuginfo
python-numpy-debugsource
python-numpy-devel
python-numpy
python3-numpy_1_13_3-gnu-hpc
python3-numpy_1_13_3-gnu-hpc-devel
python3-numpy_1_13_3-gnu-hpc-debuginfo
python-numpy_1_13_3-gnu-hpc
python-numpy_1_13_3-gnu-hpc-debuginfo
python-numpy_1_13_3-gnu-hpc-debugsource
python-numpy_1_13_3-gnu-hpc-devel
python2-numpy-gnu-hpc
python2-numpy-gnu-hpc-devel
python3-numpy-gnu-hpc
python3-numpy-gnu-hpc-devel
python2-numpy
numpy
python3-numpy-f2py
numpy-debugsource
python2-numpy-f2py
python3-numpy
numpy-debuginfo
python2-numpy-debuginfo
python2-numpy-debugsource
python2-numpy-devel
python2-numpy_1_16_5-gnu-hpc
python2-numpy_1_16_5-gnu-hpc-debuginfo
python2-numpy_1_16_5-gnu-hpc-devel
python-numpy_1_16_5-gnu-hpc-debugsource
numpy (Red Hat package)
python3-numpy-debuginfo
python3-numpy-devel
python-numpy_1_17_3-gnu-hpc-debugsource
python3-numpy_1_17_3-gnu-hpc
python3-numpy_1_17_3-gnu-hpc-debuginfo
python3-numpy_1_17_3-gnu-hpc-devel
python3-numpy (Ubuntu package)
Dell EMC PowerStore Family Operating System

How to mitigate CVE-2021-41496

Install updates from vendor's website.

Numpy - update to 1.22.0
python-numpy-debuginfo - update to 1.8.0-5.11.1
python-numpy-debugsource - addressed in versions 1.8.0-5.11.1, 1.17.3-10.1
python-numpy-devel - update to 1.8.0-5.11.1
python-numpy - update to 1.8.0-5.11.1
python3-numpy_1_13_3-gnu-hpc - update to 1.13.3-4.12.1
python3-numpy_1_13_3-gnu-hpc-devel - update to 1.13.3-4.12.1
python3-numpy_1_13_3-gnu-hpc-debuginfo - update to 1.13.3-4.12.1
python-numpy_1_13_3-gnu-hpc - update to 1.13.3-4.12.1
python-numpy_1_13_3-gnu-hpc-debuginfo - update to 1.13.3-4.12.1
python-numpy_1_13_3-gnu-hpc-debugsource - update to 1.13.3-4.12.1
python-numpy_1_13_3-gnu-hpc-devel - update to 1.13.3-4.12.1
python2-numpy-gnu-hpc - addressed in versions 1.13.3-4.12.1, 1.16.5-150000.1.9.1, 1.16.5-150200.3.5.1
python2-numpy-gnu-hpc-devel - addressed in versions 1.13.3-4.12.1, 1.16.5-150000.1.9.1, 1.16.5-150200.3.5.1
python3-numpy-gnu-hpc - addressed in versions 1.13.3-4.12.1, 1.17.3-10.1
python3-numpy-gnu-hpc-devel - addressed in versions 1.13.3-4.12.1, 1.17.3-10.1
python2-numpy - update to 1.16.5-4
numpy - update to 1.16.5-4
python3-numpy-f2py - update to 1.16.5-4
numpy-debugsource - update to 1.16.5-4
python2-numpy-f2py - update to 1.16.5-4
python3-numpy - update to 1.16.5-4
numpy-debuginfo - update to 1.16.5-4
python2-numpy - addressed in versions 1.16.5-150000.1.9.1, 1.16.5-150200.3.5.1
python2-numpy-debuginfo - addressed in versions 1.16.5-150000.1.9.1, 1.16.5-150200.3.5.1
python2-numpy-debugsource - addressed in versions 1.16.5-150000.1.9.1, 1.16.5-150200.3.5.1
python2-numpy-devel - addressed in versions 1.16.5-150000.1.9.1, 1.16.5-150200.3.5.1
python2-numpy_1_16_5-gnu-hpc - addressed in versions 1.16.5-150000.1.9.1, 1.16.5-150200.3.5.1
python2-numpy_1_16_5-gnu-hpc-debuginfo - addressed in versions 1.16.5-150000.1.9.1, 1.16.5-150200.3.5.1
python2-numpy_1_16_5-gnu-hpc-devel - addressed in versions 1.16.5-150000.1.9.1, 1.16.5-150200.3.5.1
python-numpy_1_16_5-gnu-hpc-debugsource - update to 1.16.5-150200.3.5.1
numpy (Red Hat package) - update to 1.17.0-8.el8ost
python3-numpy - update to 1.17.3-10.1
python3-numpy-debuginfo - update to 1.17.3-10.1
python3-numpy-devel - update to 1.17.3-10.1
python-numpy_1_17_3-gnu-hpc-debugsource - update to 1.17.3-10.1
python3-numpy_1_17_3-gnu-hpc - update to 1.17.3-10.1
python3-numpy_1_17_3-gnu-hpc-debuginfo - update to 1.17.3-10.1
python3-numpy_1_17_3-gnu-hpc-devel - update to 1.17.3-10.1
python3-numpy (Ubuntu package) - addressed in versions 1:1.17.4-5ubuntu3.1, 1:1.21.5-1ubuntu22.04.1, 1:1.21.5-1ubuntu22.10.1
Dell EMC PowerStore Family Operating System - update to 4.0.0.0-2284811
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.5.1

External References

Related Security Bulletins