CVE-2019-6446: Numpy Deserialization of Untrusted Data
Summary
CVE-2019-6446: Numpy Deserialization of Untrusted Data. Affects numpy versions < 1.16.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NumPy is a popular Python package used for scientific computing and data analysis. It provides support for large, multi-dimensional arrays and matrices, along with a collection of mathematical functions to operate on these arrays. NumPy is widely used in various domains, including machine learning, data science, and numerical computations. However, versions up to and including 1.16.0 of NumPy are vulnerable to a deserialization issue when using the pickle Python module. This vulnerability allows remote attackers to execute arbitrary code by exploiting a crafted serialized object, such as through a numpy.load call.
Vulnerability Detail
The vulnerability in NumPy arises from its unsafe usage of the pickle module. By allowing the deserialization of untrusted data, an attacker can construct a malicious serialized object that, when loaded by NumPy, triggers the execution of arbitrary code. This can lead to various security risks, including remote code execution, privilege escalation, and unauthorized access to sensitive data. It is important to note that there is a dispute regarding the severity of this issue, as some argue that the behavior exploited by the vulnerability can have legitimate applications when loading serialized Python object arrays from trusted and authenticated sources.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, it is advised to avoid loading serialized objects from untrusted sources using NumPy. If possible, consider using alternative methods for deserialization or ensure that the serialized objects come from trusted and authenticated sources.
Conclusion
In conclusion, the vulnerability in NumPy (CVE-2019-6446) allows remote attackers to execute arbitrary code by exploiting a deserialization issue when using the pickle module. It is crucial to update to a version of NumPy that is not affected by the vulnerability (higher than 1.16.0) and avoid loading serialized objects from untrusted sources. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for numpy →
FAQ
NumPy is a Python package used for scientific computing and data analysis. It provides support for large, multi-dimensional arrays and matrices, along with a collection of mathematical functions to operate on these arrays.
The vulnerability allows remote attackers to execute arbitrary code, which can lead to various security risks, including remote code execution, privilege escalation, and unauthorized access to sensitive data.
Yes, upgrading to a version of NumPy higher than 1.16.0 fixes the vulnerability. Users should update their NumPy package by running 'pip install --upgrade numpy'.
As a workaround, it is advised to avoid loading serialized objects from untrusted sources using NumPy. If possible, consider using alternative methods for deserialization or ensure that the serialized objects come from trusted and authenticated sources.
The dispute arises from the fact that the behavior exploited by the vulnerability can have legitimate applications when loading serialized Python object arrays from trusted and authenticated sources. However, it is still considered a security risk when dealing with untrusted data.
References
Related vulnerabilities
Recent vulnerabilities recorded for numpy.
