Bug 1483686 (CVE-2017-12852)

Summary:	CVE-2017-12852 numpy: Missing input validation on empty list or ndarray in numpy.pad function
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	apevec, chrisw, cstratak, cvsbot-xmlrpc, gwync, hhorak, jjoyce, jorton, jschluet, jspaleta, kbasil, lhh, lpeer, markmc, nforro, orion, pkilambi, python-maint, rbryant, rdieter, sclewis, tdecacqu, TicoTimo, tomspur, torsava
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:21:47 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1483689, 1483690
Bug Blocks:

Description Pedro Sampaio 2017-08-21 18:03:07 UTC

The numpy.pad function in Numpy 1.13.1 and older versions is missing
input validation. An empty list or ndarray will stick into an infinite
loop, which can allow attackers to cause a DoS attack.

Upstream bug:

https://github.com/numpy/numpy/issues/9560#issuecomment-322395292

Comment 1 Pedro Sampaio 2017-08-21 18:10:01 UTC

Created numpy tracking bugs for this issue:

Affects: fedora-all [bug 1483690]


Created python3-numpy tracking bugs for this issue:

Affects: epel-all [bug 1483689]