Buffer overflow in Numpy - CVE-2021-33430

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU61603

Buffer overflow in Numpy - CVE-2021-33430

Published: March 24, 2022


Vulnerability identifier: #VU61603
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-33430
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the PyArray_NewFromDescr_int() function of ctors.c. A remote attacker can pass specially crafted data to the library and perform a denial of service (DoS) attack.


Affected software

Numpy
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Module for HPC
SUSE Linux Enterprise Server
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Module for Python2
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
openSUSE Leap
Ubuntu
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Red Hat OpenStack
Red Hat OpenStack for IBM Power
Red Hat OpenStack Director Deployment Tools
python-numpy-debuginfo
python-numpy-debugsource
python-numpy-devel
python-numpy
python-numpy_1_13_3-gnu-hpc
python3-numpy_1_13_3-gnu-hpc
python3-numpy_1_13_3-gnu-hpc-debuginfo
python3-numpy_1_13_3-gnu-hpc-devel
python3-numpy-gnu-hpc-devel
python3-numpy-gnu-hpc
python2-numpy-gnu-hpc-devel
python2-numpy-gnu-hpc
python-numpy_1_13_3-gnu-hpc-devel
python-numpy_1_13_3-gnu-hpc-debugsource
python-numpy_1_13_3-gnu-hpc-debuginfo
python2-numpy_1_16_5-gnu-hpc-debuginfo
python2-numpy_1_16_5-gnu-hpc-devel
python2-numpy_1_16_5-gnu-hpc
python2-numpy-devel
python2-numpy-debugsource
python2-numpy-debuginfo
python2-numpy
python-numpy_1_16_5-gnu-hpc-debugsource
numpy (Red Hat package)
python3-numpy
python3-numpy-devel
python3-numpy-debuginfo
python3-numpy_1_17_3-gnu-hpc-devel
python3-numpy_1_17_3-gnu-hpc-debuginfo
python-numpy_1_17_3-gnu-hpc-debugsource
python3-numpy_1_17_3-gnu-hpc
python3-numpy (Ubuntu package)
Dell EMC PowerStore Family Operating System

How to mitigate CVE-2021-33430

Install updates from vendor's website.

Numpy - update to 1.21.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.0.9
python-numpy-debuginfo - update to 1.8.0-5.11.1
python-numpy-debugsource - addressed in versions 1.8.0-5.11.1, 1.17.3-10.1
python-numpy-devel - update to 1.8.0-5.11.1
python-numpy - update to 1.8.0-5.11.1
python-numpy_1_13_3-gnu-hpc - update to 1.13.3-4.12.1
python3-numpy_1_13_3-gnu-hpc - update to 1.13.3-4.12.1
python3-numpy_1_13_3-gnu-hpc-debuginfo - update to 1.13.3-4.12.1
python3-numpy_1_13_3-gnu-hpc-devel - update to 1.13.3-4.12.1
python3-numpy-gnu-hpc-devel - addressed in versions 1.13.3-4.12.1, 1.17.3-10.1
python3-numpy-gnu-hpc - addressed in versions 1.13.3-4.12.1, 1.17.3-10.1
python2-numpy-gnu-hpc-devel - addressed in versions 1.13.3-4.12.1, 1.16.5-150000.1.9.1, 1.16.5-150200.3.5.1
python2-numpy-gnu-hpc - addressed in versions 1.13.3-4.12.1, 1.16.5-150000.1.9.1, 1.16.5-150200.3.5.1
python-numpy_1_13_3-gnu-hpc-devel - update to 1.13.3-4.12.1
python-numpy_1_13_3-gnu-hpc-debugsource - update to 1.13.3-4.12.1
python-numpy_1_13_3-gnu-hpc-debuginfo - update to 1.13.3-4.12.1
python2-numpy_1_16_5-gnu-hpc-debuginfo - addressed in versions 1.16.5-150000.1.9.1, 1.16.5-150200.3.5.1
python2-numpy_1_16_5-gnu-hpc-devel - addressed in versions 1.16.5-150000.1.9.1, 1.16.5-150200.3.5.1
python2-numpy_1_16_5-gnu-hpc - addressed in versions 1.16.5-150000.1.9.1, 1.16.5-150200.3.5.1
python2-numpy-devel - addressed in versions 1.16.5-150000.1.9.1, 1.16.5-150200.3.5.1
python2-numpy-debugsource - addressed in versions 1.16.5-150000.1.9.1, 1.16.5-150200.3.5.1
python2-numpy-debuginfo - addressed in versions 1.16.5-150000.1.9.1, 1.16.5-150200.3.5.1
python2-numpy - addressed in versions 1.16.5-150000.1.9.1, 1.16.5-150200.3.5.1
python-numpy_1_16_5-gnu-hpc-debugsource - update to 1.16.5-150200.3.5.1
numpy (Red Hat package) - update to 1.17.0-8.el8ost
python3-numpy - update to 1.17.3-10.1
python3-numpy-devel - update to 1.17.3-10.1
python3-numpy-debuginfo - update to 1.17.3-10.1
python3-numpy_1_17_3-gnu-hpc-devel - update to 1.17.3-10.1
python3-numpy_1_17_3-gnu-hpc-debuginfo - update to 1.17.3-10.1
python-numpy_1_17_3-gnu-hpc-debugsource - update to 1.17.3-10.1
python3-numpy_1_17_3-gnu-hpc - update to 1.17.3-10.1
python3-numpy (Ubuntu package) - addressed in versions 1:1.17.4-5ubuntu3.1, 1:1.21.5-1ubuntu22.04.1, 1:1.21.5-1ubuntu22.10.1
Dell EMC PowerStore Family Operating System - update to 4.0.0.0-2284811

External References

Related Security Bulletins