CVE-2021-41496

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2021-41496
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41496.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-41496
Aliases
Related
Withdrawn
2022-02-07T18:10:33Z
Published
2021-12-17T20:15:08Z
Modified
2025-02-19T03:23:18.874109Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

Buffer overflow in the arrayfrompyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values. NOTE: The vendor does not agree this is a vulnerability; the negative dimensions can only be created by an already privileged user (or internally)

References

Affected packages

Debian:11 / numpy

Package

Name
numpy
Purl
pkg:deb/debian/numpy?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1:1.*

1:1.19.5-1
1:1.20.0-1
1:1.20.2-1
1:1.21.2-1
1:1.21.2-2
1:1.21.2-3
1:1.21.4-1
1:1.21.4-2
1:1.21.5-1
1:1.21.5-2
1:1.22.1-1
1:1.23.1-1
1:1.23.2-1
1:1.23.3-1
1:1.23.5-1
1:1.23.5-2
1:1.24.0-1
1:1.24.1-1
1:1.24.1-2
1:1.24.2-1~hurd.1
1:1.24.2-1
1:1.24.2-2
1:1.24.2-2+hurd.1
1:1.24.2-3
1:1.26.3-1
1:1.26.3-2
1:1.26.4+ds-1
1:1.26.4+ds-2
1:1.26.4+ds-3
1:1.26.4+ds-4
1:1.26.4+ds-5
1:1.26.4+ds-6
1:1.26.4+ds-7
1:1.26.4+ds-8
1:1.26.4+ds-9~exp1
1:1.26.4+ds-9
1:1.26.4+ds-10
1:1.26.4+ds-11
1:1.26.4+ds-12
1:1.26.4+ds-13

1:2.*

1:2.1.0+ds-1
1:2.1.0+ds-2
1:2.1.1+ds-1
1:2.1.1+ds-2
1:2.1.1+ds-3
1:2.1.2+ds-1
1:2.1.3+ds-1
1:2.1.3+ds-2
1:2.2.0+ds-1
1:2.2.1+ds-1
1:2.2.1+ds-2
1:2.2.2+ds-1
1:2.2.2+ds-2
1:2.2.3+ds-1

Ecosystem specific 

{
    "urgency": "unimportant"
}

Debian:12 / numpy

Package

Name
numpy
Purl
pkg:deb/debian/numpy?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1:1.*

1:1.24.2-1
1:1.24.2-1+deb12u1
1:1.24.2-2
1:1.24.2-2+hurd.1
1:1.24.2-3
1:1.26.3-1
1:1.26.3-2
1:1.26.4+ds-1
1:1.26.4+ds-2
1:1.26.4+ds-3
1:1.26.4+ds-4
1:1.26.4+ds-5
1:1.26.4+ds-6
1:1.26.4+ds-7
1:1.26.4+ds-8
1:1.26.4+ds-9~exp1
1:1.26.4+ds-9
1:1.26.4+ds-10
1:1.26.4+ds-11
1:1.26.4+ds-12
1:1.26.4+ds-13

1:2.*

1:2.1.0+ds-1
1:2.1.0+ds-2
1:2.1.1+ds-1
1:2.1.1+ds-2
1:2.1.1+ds-3
1:2.1.2+ds-1
1:2.1.3+ds-1
1:2.1.3+ds-2
1:2.2.0+ds-1
1:2.2.1+ds-1
1:2.2.1+ds-2
1:2.2.2+ds-1
1:2.2.2+ds-2
1:2.2.3+ds-1

Ecosystem specific 

{
    "urgency": "unimportant"
}

Debian:13 / numpy

Package

Name
numpy
Purl
pkg:deb/debian/numpy?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1:1.*

1:1.24.2-1
1:1.24.2-2
1:1.24.2-2+hurd.1
1:1.24.2-3
1:1.26.3-1
1:1.26.3-2
1:1.26.4+ds-1
1:1.26.4+ds-2
1:1.26.4+ds-3
1:1.26.4+ds-4
1:1.26.4+ds-5
1:1.26.4+ds-6
1:1.26.4+ds-7
1:1.26.4+ds-8
1:1.26.4+ds-9~exp1
1:1.26.4+ds-9
1:1.26.4+ds-10
1:1.26.4+ds-11
1:1.26.4+ds-12
1:1.26.4+ds-13

1:2.*

1:2.1.0+ds-1
1:2.1.0+ds-2
1:2.1.1+ds-1
1:2.1.1+ds-2
1:2.1.1+ds-3
1:2.1.2+ds-1
1:2.1.3+ds-1
1:2.1.3+ds-2
1:2.2.0+ds-1
1:2.2.1+ds-1
1:2.2.1+ds-2
1:2.2.2+ds-1
1:2.2.2+ds-2
1:2.2.3+ds-1

Ecosystem specific 

{
    "urgency": "unimportant"
}

Git / github.com/numpy/numpy

Affected ranges

Type
GIT
Repo
https://github.com/numpy/numpy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
92ebe1e9a6aeb47a881a1226b08218175776f9ea

Affected versions

Other

pre-removal-numpybook
with_maskna

v0.*

v0.2.2
v0.3.0

v1.*

v1.19.0rc1
v1.19.0rc2