Advisoriesby IbisNumPyGHSA-frgw-fgh6-9g52
Numpy missing input validation
Fix: upgrade to 1.13.3 or later
The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| numpy PyPI | < 1.13.3 | 1.13.3 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-835
- Also known as
- CVE-2017-12852, PYSEC-2017-1
- nvd.nist.gov/vuln/detail/CVE-2017-12852
- github.com/numpy/numpy/issues/9560#issuecomment-322395292
- github.com/BT123/testcasesForMyRequest/tree/master/CVE-2017-12852
- github.com/advisories/GHSA-frgw-fgh6-9g52
- github.com/numpy/numpy
- github.com/numpy/numpy/releases/tag/v1.13.3
- github.com/pypa/advisory-database/tree/main/vulns/numpy/PYSEC-2017-1.yaml
More NumPy advisories
All NumPy
Numpy Deserialization of Untrusted DataCVE-2019-6446fixed in 1.16.3Arbitrary file write in NumPyCVE-2014-1858fixed in 1.8.1Numpy arbitrary file write via symlink attackCVE-2014-1859fixed in 1.8.1NumPy NULL Pointer DereferenceCVE-2021-41495fixed in 1.19Buffer Copy without Checking Size of Input in NumPyCVE-2021-41496fixed in 1.19NumPy Buffer Overflow (Disputed)CVE-2021-33430fixed in 1.21