AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

NumPyGHSA-5545-2q6w-2gh6

NumPy NULL Pointer Dereference

NumPy

CVE-2021-41495 · Published Feb 8, 2022 · updated Nov 8, 2023

High7.5
Fix: upgrade to 1.19 or later
GitHub advisory

Null Pointer Dereference vulnerability exists in numpy.sort in NumPy &lt and 1.19 in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays.

Affected versions

PackageAffectedFixed in
numpy
PyPI
< 1.191.19
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-476
Also known as
CVE-2021-41495, PYSEC-2021-856

More NumPy advisories

All NumPy
High 5.5May 14, 2022Arbitrary file write in NumPyCVE-2014-1858fixed in 1.8.1High 5.5May 14, 2022Numpy arbitrary file write via symlink attackCVE-2014-1859fixed in 1.8.1High 7.5May 13, 2022Numpy missing input validationCVE-2017-12852fixed in 1.13.3Medium 5.5Feb 8, 2022Buffer Copy without Checking Size of Input in NumPyCVE-2021-41496fixed in 1.19Medium 5.3Jan 7, 2022NumPy Buffer Overflow (Disputed)CVE-2021-33430fixed in 1.21Medium 5.3Dec 18, 2021Incorrect Comparison in NumPyCVE-2021-34141fixed in 1.22