Incomplete String Comparison Vulnerability in NumPy: CVE-2021-34141
Summary
DEBIAN-CVE-2021-34141: An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. Affects numpy versions 1:1.19.5-1 – 1:2.3.3+ds-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NumPy is a widely-used open-source library for the Python programming language, primarily utilized for numerical and scientific computing. It provides support for large, multi-dimensional arrays and matrices, along with a collection of mathematical functions to operate on these arrays. This library is essential for data analysis, machine learning, and scientific research. However, an incomplete string comparison in the numpy.core component has been identified, which could potentially lead to incorrect copying of string objects.
Vulnerability Detail
The vulnerability, identified as CVE-2021-34141, arises from an incomplete string comparison in the numpy.core component of NumPy versions prior to 1.22.0. This flaw allows attackers to create specific string objects that can trigger slightly incorrect copying behavior. Although the vendor has stated that this behavior is 'completely harmless,' it still poses a risk as it could lead to unexpected behavior in applications relying on NumPy for string manipulations.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid using specific string objects that may trigger the incorrect copying behavior until they can update to the patched version. However, the vendor has indicated that the behavior is harmless, so immediate action may not be necessary.
Conclusion
In summary, CVE-2021-34141 is an incomplete string comparison vulnerability in NumPy that affects versions prior to 1.22.0. While the vendor considers the behavior harmless, it is advisable to update to the latest version to ensure the integrity of applications using NumPy. Users can also utilize Vulert to monitor for vulnerabilities in their software.
See every vulnerability recorded for numpy →
FAQ
CVE-2021-34141 is a vulnerability in NumPy that arises from an incomplete string comparison, allowing for potentially incorrect copying of string objects.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
All versions of NumPy prior to 1.22.0 are affected by this vulnerability.
The vendor has classified the urgency of this vulnerability as 'unimportant,' indicating that it is not critical but should still be addressed.
If you cannot update immediately, consider avoiding the use of specific string objects that may trigger the issue until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for numpy.
