CVE-2019-6446: Unsafe Usage of Pickle Module in NumPy
Summary
CVE-2019-6446: DISPUTED An issue was discovered in NumPy 1.16.0 and earlier. Affects numpy versions < 1.16.1. Fixed in 1.16.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NumPy is a popular Python package used for scientific computing and data analysis. It provides support for large, multi-dimensional arrays and matrices, along with a collection of mathematical functions to operate on these arrays. NumPy is widely used in various domains, including machine learning, data science, and numerical computations. However, versions up to 1.16.0 of NumPy are vulnerable to a security issue that involves the unsafe usage of the pickle Python module.
Vulnerability Detail
The vulnerability in NumPy arises from its unsafe usage of the pickle module. This allows remote attackers to execute arbitrary code by exploiting a crafted serialized object, typically through a numpy.load call. The issue stems from the fact that NumPy does not properly validate or sanitize the input when deserializing objects using pickle. As a result, an attacker can construct a malicious serialized object that, when loaded by NumPy, triggers the execution of arbitrary code on the target system. It is important to note that there is a dispute regarding the severity of this vulnerability, as some argue that the behavior exploited by the attack could have legitimate applications, such as loading serialized Python object arrays from trusted and authenticated sources.
How To Fix
Minimum fixed version
1.16.1
This is the first release that contains the fix.
pip install --upgrade "numpy==1.16.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating NumPy is not immediately feasible, a possible workaround is to avoid using the pickle module for deserialization in NumPy. Instead, consider using alternative serialization libraries or methods that provide stronger security guarantees. By avoiding the use of pickle, the risk of exploitation through crafted serialized objects is mitigated.
Conclusion
The vulnerability in NumPy, CVE-2019-6446, highlights the importance of keeping software dependencies up to date. By updating to the latest version of NumPy, users can ensure that their systems are protected against this security issue. Additionally, avoiding the use of the pickle module for deserialization in NumPy can provide a temporary workaround until the update is applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for numpy →
FAQ
NumPy is a Python package that provides support for large, multi-dimensional arrays and matrices, along with a collection of mathematical functions to operate on these arrays. It is widely used in scientific computing, data analysis, and various other domains.
The vulnerability allows remote attackers to execute arbitrary code on systems running vulnerable versions of NumPy. This can lead to unauthorized access, data theft, or the execution of malicious commands.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just Pipfile.lock, without requiring access to the code or installation.
Yes, the developers of NumPy have released a fix for this vulnerability in version 1.16.1. It is recommended to update to the latest version to ensure the security of your system.
If updating NumPy is not immediately feasible, you can mitigate the risk by avoiding the use of the pickle module for deserialization in NumPy. Consider using alternative serialization libraries or methods that provide stronger security guarantees.
Related vulnerabilities
Recent vulnerabilities recorded for numpy.
