CVE-2017-12852: Denial of Service Vulnerability in python-numpy
Summary
CVE-2017-12852: The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. Affects python-numpy versions < 1:1.14.3-1. Fixed in 1:1.14.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-numpy is a popular package in the Debian ecosystem that provides support for large, multi-dimensional arrays and matrices, along with a collection of mathematical functions to operate on these arrays. It is widely used in scientific computing and data analysis. However, versions 1.13.1 and older of python-numpy are vulnerable to a Denial of Service (DoS) attack due to missing input validation in the numpy.pad function.
Vulnerability Detail
The numpy.pad function in python-numpy allows users to add padding to an array. However, it lacks proper input validation, which can lead to an infinite loop when an empty list or ndarray is passed as input. This vulnerability can be exploited by attackers to cause a DoS attack, potentially impacting the availability of the affected system. The issue has been assigned the CVE identifier CVE-2017-12852 and has a CVSSv3 score of 7.5.
How To Fix
Minimum fixed version
1:1.14.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-numpyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the numpy.pad function with empty lists or ndarrays as input. It is advisable to validate the input before passing it to the function to ensure it is not empty. Here is an example of how to perform input validation before calling numpy.pad:
import numpy as np
def safe_pad(array, pad_width, mode):
if len(array) == 0:
raise ValueError('Input array cannot be empty')
return np.pad(array, pad_width, mode)
Conclusion
The vulnerability CVE-2017-12852 in python-numpy versions 1.13.1 and older can be exploited to cause a Denial of Service (DoS) attack. It is crucial to upgrade to version 1.14.3-1 or later to mitigate this vulnerability. Users can also implement input validation as a temporary workaround to prevent the issue. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-numpy →
FAQ
python-numpy is a package that provides support for large, multi-dimensional arrays and matrices, along with mathematical functions to operate on these arrays. It is widely used in scientific computing and data analysis.
The numpy.pad function is used to add padding to an array. It allows users to specify the width of padding and the padding mode.
Input validation is the process of ensuring that the input provided to a function or program meets certain criteria or constraints. It helps prevent unexpected behavior or vulnerabilities caused by invalid or malicious input.
A Denial of Service (DoS) attack is an attempt to make a computer system or network unavailable to its intended users by overwhelming it with a flood of illegitimate requests or by exploiting vulnerabilities to cause a system crash or slowdown.
This vulnerability in python-numpy can be exploited by attackers to cause a DoS attack, potentially impacting the availability of the affected system. It can lead to system crashes or slowdowns, affecting the normal operation of applications relying on python-numpy.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-numpy.
