Critical Security Update for numpy: Addressing CVE-2021-41495 in Red Hat OpenStack Platform 16.1
Summary
RHSA-2022:8861: Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.9 (numpy) security update. Affects numpy versions < 1:1.17.0-11.el8ost. Fixed in 1:1.17.0-11.el8ost. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
numpy is a fundamental package for scientific computing in Python, providing support for large, multi-dimensional arrays and matrices, along with a collection of mathematical functions to operate on these arrays. It is widely used in data analysis, machine learning, and scientific research. The vulnerability in question affects versions prior to 1:1.17.0-11.el8ost, potentially exposing systems to security risks.
Vulnerability Detail
CVE-2021-41495 is a security vulnerability that arises from improper handling of certain inputs in numpy. This can lead to potential denial of service (DoS) attacks, where an attacker could exploit the vulnerability to crash the application or cause it to behave unexpectedly. The vulnerability has a CVSS score of 7.5, indicating a high severity level, which necessitates immediate attention from users of affected versions.
How To Fix
Minimum fixed version
1:1.17.0-11.el8ost
This is the first release that contains the fix.
sudo dnf update numpyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the affected application or limit the input data to mitigate the risk of exploitation until the package is updated.
Conclusion
The numpy package in Red Hat OpenStack Platform 16.1 is affected by a critical vulnerability (CVE-2021-41495) that requires immediate attention. Users are advised to update to the patched version to mitigate potential security risks. For those unable to update immediately, temporary workarounds are available to reduce exposure.
See every vulnerability recorded for numpy →
FAQ
CVE-2021-41495 is a security vulnerability in the numpy package that can lead to denial of service attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing access restrictions or limiting input data to reduce the risk of exploitation.
Failing to address this vulnerability could lead to application crashes or unexpected behavior, potentially compromising the integrity and availability of your systems.
More information can be found in the Red Hat Security Advisory at https://security.access.redhat.com/data/osv/RHSA-2022:8861.json.
Related vulnerabilities
Recent vulnerabilities recorded for numpy.
