Bug 2345674 - CVE-2025-26519 python-pandas: input-controlled out-of-bounds write primitive in iconv() [fedora-41]
Summary: CVE-2025-26519 python-pandas: input-controlled out-of-bounds write primitive...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: python-pandas
Version: 41
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
Assignee: Jonathan Wright
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: {"flaws": ["e723ba4c-f49b-40e6-b88e-5...
Depends On:
Blocks: CVE-2025-26519
TreeView+ depends on / blocked
 
Reported: 2025-02-14 05:14 UTC by Avinash Hanwate
Modified: 2025-02-14 11:05 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2025-02-14 11:05:32 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Avinash Hanwate 2025-02-14 05:14:39 UTC
More information about this security flaw is available in the following bug:

https://bugzilla.redhat.com/show_bug.cgi?id=2345671

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Comment 1 Ben Beasley 2025-02-14 11:05:32 UTC
The CVE pertains to the iconv() implementation in musl-libc.

The only known code from musl-libc in Pandas is a small set of C preprocessor macros in pandas/_libs/include/pandas/portable.h:

// GH-23516 - works around locale perf issues
// from MUSL libc, licence at LICENSES/MUSL_LICENSE
#define isdigit_ascii(c) (((unsigned)(c) - '0') < 10u)
#define getdigit_ascii(c, default)                                             \
  (isdigit_ascii(c) ? ((int)((c) - '0')) : default)
#define isspace_ascii(c) (((c) == ' ') || (((unsigned)(c) - '\t') < 5))
#define toupper_ascii(c) ((((unsigned)(c) - 'a') < 26) ? ((c) & 0x5f) : (c))
#define tolower_ascii(c) ((((unsigned)(c) - 'A') < 26) ? ((c) | 0x20) : (c))

Therefore, Pandas cannot be affected.


Note You need to log in before you can comment on or make changes to this bug.