PatchTheCVEnumpy vulnerabilities and fixes
Recent CVEs affecting numpy, with upgrade or downgrade steps. 8 tracked.
numpy has 8 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 8. Most recent: 2021-12-17. Highest priority: CVE-2019-6446 (score 69/100).
- CVE-2021-34141 MEDIUM 5.3 UPGRADE DOWNGRADE An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger
- CVE-2021-41496 MEDIUM 5.5 UPGRADE Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to
- CVE-2021-41495 MEDIUM 5.3 UPGRADE Null Pointer Dereference vulnerability exists in numpy.sort in NumPy < and 1.19 in the PyArray_DescrNew func
- CVE-2021-33430 MEDIUM 5.3 UPGRADE A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when
- CVE-2019-6446 CRITICAL 9.8 UPGRADE MITIGATE An issue was discovered in NumPy before 1.16.3
- CVE-2017-12852 HIGH 7.5 UPGRADE The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation
- CVE-2014-1859 MEDIUM 5.5 UPGRADE MITIGATE (1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_i
- CVE-2014-1858 MEDIUM 5.5 UPGRADE __init__.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack
FAQ
How do I fix numpy vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is numpy being exploited right now?
None of the tracked numpy CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which numpy CVE should I patch first?
CVE-2019-6446 currently ranks highest (69/100): An issue was discovered in NumPy before 1.16.3.