CVE-2021-34141: Incomplete string comparison in numpy.core component in NumPy 1.9.x
Summary
CVE-2021-34141: Incomplete string comparison in the numpy.core component in NumPy1.9.x, which allows attackers to fail the APIs via constructing specific string objects. Affects numpy versions >= 1.9.0, < 1.10.0. Fixed in 1.10.0. How to fix ↓
Also tracked for
- numpy · Debian:11
The same CVE-2021-34141 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NumPy is a popular package in the Python ecosystem that provides support for large, multi-dimensional arrays and matrices, along with a collection of mathematical functions to operate on these arrays. It is extensively used in scientific computing and data analysis applications. However, versions 1.9.x of NumPy are vulnerable to an incomplete string comparison issue in the numpy.core component.
Vulnerability Detail
The vulnerability arises due to the incomplete string comparison in the numpy.core component of NumPy 1.9.x. Attackers can exploit this flaw by constructing specific string objects to cause the APIs to fail. This vulnerability can potentially lead to unexpected behavior, crashes, or denial of service in applications that rely on NumPy 1.9.x.
How To Fix
Minimum fixed version
1.10.0
This is the first release that contains the fix.
pip install --upgrade "numpy==1.10.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Users are advised to follow the recommended fix and upgrade to a non-vulnerable version of NumPy.
Conclusion
In conclusion, the vulnerability (CVE-2021-34141) in NumPy 1.9.x arises from an incomplete string comparison issue in the numpy.core component. It is crucial for users to update their NumPy installation to a non-vulnerable version, such as NumPy 1.10.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for numpy →
FAQ
NumPy is a Python package that provides support for large, multi-dimensional arrays and matrices, along with a collection of mathematical functions to operate on these arrays.
The vulnerability can result in unexpected behavior, crashes, or denial of service in applications that use NumPy 1.9.x.
Versions 1.9.x of NumPy are affected by this vulnerability.
Yes, the vulnerability has been fixed in NumPy 1.10.0 and later versions.
To mitigate this vulnerability, it is recommended to upgrade to a fixed version of NumPy, specifically version 1.10.0 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for numpy.
