GHSA-f7c7-j99h-c22f

Buffer Copy without Checking Size of Input in NumPy

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-41496

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	numpy	< 1.19	1.19

Details

As written in the advisory (Markdown source, shown as plain text).

Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-41496 advisory
https://github.com/numpy/numpy/issues/19000 web
https://github.com/numpy/numpy package
https://www.oracle.com/security-alerts/cpujul2022.html web