Symlink Attack Vulnerability in Python-Numpy Package: CVE-2014-1858
Summary
UBUNTU-CVE-2014-1858: init.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file. Affects python-numpy versions < 1:1.8.2-0ubuntu0.1. Fixed in 1:1.8.2-0ubuntu0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-Numpy is a widely used library for numerical computations in Python, providing support for large, multi-dimensional arrays and matrices, along with a collection of mathematical functions to operate on these arrays. The library is essential for scientific computing and data analysis, making it a critical component in many Python-based applications. However, a vulnerability was identified in versions prior to 1.8.1, which allows local users to exploit symlink attacks on temporary files, potentially leading to unauthorized file writes.
Vulnerability Detail
The vulnerability, identified as CVE-2014-1858, exists in the init.py file of the f2py module within NumPy before version 1.8.1. It allows local users to create symbolic links to arbitrary files, which can be exploited during the creation of temporary files. This can lead to unauthorized file modifications or overwrites, posing a significant risk to system integrity and data security. The vulnerability has a CVSS score of 5.5, indicating a moderate level of severity.
How To Fix
Minimum fixed version
1:1.8.2-0ubuntu0.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-numpyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can restrict access to the directories where temporary files are created, or avoid using the f2py module until the package is updated. However, this may limit functionality and is not a permanent solution.
Conclusion
In summary, CVE-2014-1858 is a significant vulnerability in the Python-Numpy package that can lead to unauthorized file writes through symlink attacks. It is crucial to update to the patched version to mitigate this risk. Users should also consider using tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for python-numpy →
FAQ
CVE-2014-1858 is a vulnerability in the Python-Numpy package that allows local users to exploit symlink attacks, potentially leading to unauthorized file writes.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of CVE-2014-1858 is 5.5, indicating a moderate level of severity.
If immediate updates are not possible, consider restricting access to the directories where temporary files are created or avoid using the f2py module.
You can visit Vulert at https://vulert.com for real-time monitoring and alerts on open-source vulnerabilities in your software.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-numpy.
