logo

Database

Insecure deserialization In numpy

Description

Numpy Deserialization of Untrusted Data ** DISPUTED ** An issue was discovered in NumPy 1.16.2 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior that might have legitimate applications in (for example) loading serialized Python object arrays from trusted and authenticated sources.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2019-64462. NVD-2019-64463. OSV-2019-64464. GHSA-9fq2-x9r6-wfmf5. GCVE-2019-64466. access.redhat.com7. access.redhat.com

References

1. https://github.com/numpy/numpy/issues/127592. https://github.com/numpy/numpy/pull/128893. https://github.com/numpy/numpy/pull/133594. https://github.com/numpy/numpy/commit/89b688732b37616c9d26623f81aaee1703c30ffb5. https://bugzilla.suse.com/show_bug.cgi?id=11222086. https://github.com/pypa/advisory-database/tree/main/vulns/numpy/PYSEC-2019-108.yaml7. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZZAYIQNUUYXGMKHSPEEXS4TRYFOUYE48. https://lists.fedoraproject.org/archives/list/[email protected]/message/7ZZAYIQNUUYXGMKHSPEEXS4TRYFOUYE49. https://web.archive.org/web/20210124234613/https://www.securityfocus.com/bid/10667010. http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00091.html11. http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00092.html12. http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00015.html13. http://www.securityfocus.com/bid/10667014. https://github.com/RayScri/CVE-2019-6446

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.