NumPyGHSA-frgw-fgh6-9g52
Numpy missing input validation
High7.5CVE-2017-12852 · Published May 13, 2022 · updated Nov 8, 2023
The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| numpy PyPI | < 1.13.3 | 1.13.3 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-835
- Also known as
- CVE-2017-12852, PYSEC-2017-1
- nvd.nist.gov/vuln/detail/CVE-2017-12852
- github.com/numpy/numpy/issues/9560#issuecomment-322395292
- github.com/BT123/testcasesForMyRequest/tree/master/CVE-2017-12852
- github.com/advisories/GHSA-frgw-fgh6-9g52
- github.com/numpy/numpy
- github.com/numpy/numpy/releases/tag/v1.13.3
- github.com/pypa/advisory-database/tree/main/vulns/numpy/PYSEC-2017-1.yaml
More NumPy advisories
All NumPy| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 242022 | Numpy Deserialization of Untrusted Data Critical9.8May 24, 2022 | Critical9.8 | 1.16.3 |
| May 142022 | Arbitrary file write in NumPyHigh5.5May 14, 2022 | High5.5 | 1.8.1 |
| May 142022 | Numpy arbitrary file write via symlink attackHigh5.5May 14, 2022 | High5.5 | 1.8.1 |
| Feb 82022 | NumPy NULL Pointer DereferenceHigh7.5Feb 8, 2022 | High7.5 | 1.19 |
| Feb 82022 | Buffer Copy without Checking Size of Input in NumPyMedium5.5Feb 8, 2022 | Medium5.5 | 1.19 |
| Jan 72022 | NumPy Buffer Overflow (Disputed)Medium5.3Jan 7, 2022 | Medium5.3 | 1.21 |