GHSA-fpfv-jqm9-f5jm

Incorrect Comparison in NumPy

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-34141

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	numpy	< 1.22	1.22

Details

As written in the advisory (Markdown source, shown as plain text).

Incomplete string comparison in the numpy.core component in NumPy1.9.x, which allows attackers to fail the APIs via constructing specific string objects.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-34141 advisory
https://github.com/numpy/numpy/issues/18993 web
https://github.com/numpy/numpy/issues/18993#issuecomment-1010735102 web
https://github.com/advisories/GHSA-fpfv-jqm9-f5jm advisory
https://github.com/numpy/numpy package
https://github.com/pypa/advisory-database/tree/main/vulns/numpy/PYSEC-2021-855.yaml web
https://www.oracle.com/security-alerts/cpujul2022.html web