Bug 2035032 (CVE-2021-34141) - CVE-2021-34141 numpy: incomplete string comparison in the numpy.core component
Summary: CVE-2021-34141 numpy: incomplete string comparison in the numpy.core component
Keywords:
Status: NEW
Alias: CVE-2021-34141
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2035033 2035072 2035073 2035074 2035075 2035076 2035077 2035078
Blocks: 2035045
TreeView+ depends on / blocked
 
Reported: 2021-12-22 18:53 UTC by Guilherme de Almeida Suckevicz
Modified: 2024-01-01 01:09 UTC (History)
26 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2021-12-22 18:53:25 UTC 
Incomplete string comparison in the numpy.core component in NumPy1.9.x, which allows attackers to fail the APIs via constructing specific string objects.

Reference:
https://github.com/numpy/numpy/issues/18993
Comment 1 Guilherme de Almeida Suckevicz 2021-12-22 18:53:41 UTC 
Created python2-numpy tracking bugs for this issue:

Affects: epel-7 [bug 2035033]
Comment 4 Garrett Tucker 2021-12-23 17:56:46 UTC 
The flaw presented here is the result of an incomplete string comparison when checking numeric style typecode as the terminator was not considered. While the string comparison flaw can result in API failure in numpy and impact availability, the flaw is unable to result in code execution or compromise confidentiality or integrity of the system. As such the NVD CVSS should be revised to 7.5/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Comment 5 Petr Viktorin (pviktori) 2022-01-03 09:20:35 UTC 
The check is used to determine if a deprecation warning should be emitted or not. How is this a security issue?

What does "fail the APIs" even mean?
Comment 6 Jason Tibbitts 2022-01-03 20:56:43 UTC 
I'm concerned that the only tracking bug created in the "Affects" section is for a package that exists only to depend on another package and has no actual code.  Perhaps there is something I cannot see since all of the other bugs in the dependency chain are inaccessible to me, but if not then it looks like the bug wasn't filed against the proper package.
Note You need to log in before you can comment on or make changes to this bug.