An issue was discovered in NumPy before 1.16.3. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior that might have legitimate applications in (for example) loading serialized Python object arrays from trusted and authenticated sources.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python2-pysocksUpgrade python2-docutilsUpgrade python2-pytestUpgrade python2-PyMySQLUpgrade python2-psycopg2Upgrade python2-CythonUpgrade python2-rpm-macrosUpgrade python2-setuptools_scmUpgrade python2-attrsUpgrade python2-funcsigsUpgrade python2-pytest-mockUpgrade python2-docsUpgrade python2-dnsUpgrade python2-psycopg2-debugUpgrade python2-psycopg2-testsUpgrade python2-ipaddressUpgrade python2-markupsafeUpgrade python2-coverageUpgrade python2-mockUpgrade python2-pyyamlUpgrade python2-pyUpgrade python2-docs-infoUpgrade python2-pytzUpgrade python2-pluggyUpgrade python2-chardetUpgrade python2-idnaUpgrade python-psycopg2-doc | May 4, 2022 | Jan 16, 2019 |
| Centos_linux | — | Upgrade python2Upgrade python2-dnsUpgrade python2-CythonUpgrade python2-numpy-debuginfoUpgrade python2-pyUpgrade python2-docs-infoUpgrade python2-setuptools_scmUpgrade python2-tkinterUpgrade python2-testUpgrade python2-scipy-debuginfoUpgrade python2-pytestUpgrade python2-debugsourceUpgrade python2-pymongo-debuginfoUpgrade python2-pluggyUpgrade python2-pymongoUpgrade python2-funcsigsUpgrade python2-coverageUpgrade python2-debugUpgrade python2-bson-debuginfoUpgrade python2-bsonUpgrade python2-toolsUpgrade python2-pip-wheelUpgrade python2-setuptoolsUpgrade python2-idnaUpgrade python2-numpyUpgrade python2-docutilsUpgrade python2-backportsUpgrade python2-numpy-docUpgrade babelUpgrade python-sqlalchemy-docUpgrade python2-attrsUpgrade python2-pyyaml-debuginfoUpgrade python2-pymongo-gridfsUpgrade python2-pytest-mockUpgrade python2-ipaddressUpgrade python2-PyMySQLUpgrade python-pymongo-debuginfoUpgrade python2-virtualenvUpgrade python2-psycopg2Upgrade python2-lxmlUpgrade python2-sqlalchemyUpgrade python2-develUpgrade python2-docsUpgrade python2-markupsafeUpgrade python2-pygmentsUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-requestsUpgrade Cython-debugsourceUpgrade python2-scipyUpgrade python2-pysocksUpgrade python2-libsUpgrade python-coverage-debugsourceUpgrade python2-urllib3Upgrade python2-wheelUpgrade python2-mockUpgrade python2-psycopg2-debugUpgrade python-psycopg2-debugsourceUpgrade python2-debuginfoUpgrade python2-psycopg2-testsUpgrade python-lxml-debugsourceUpgrade python3-numpyUpgrade scipy-debugsourceUpgrade python2-pipUpgrade python2-noseUpgrade python2-sixUpgrade python-pymongo-debugsourceUpgrade python3-numpy-debuginfoUpgrade python2-lxml-debuginfoUpgrade numpy-debugsourceUpgrade python2-Cython-debuginfoUpgrade python2-wheel-wheelUpgrade python2-backports-ssl_match_hostnameUpgrade python2-psycopg2-debuginfoUpgrade python-psycopg2-debuginfoUpgrade python2-pyyamlUpgrade python2-pytzUpgrade python2-babelUpgrade python2-numpy-f2pyUpgrade PyYAML-debugsourceUpgrade python2-setuptools-wheelUpgrade python-psycopg2-docUpgrade python3-numpy-f2pyUpgrade python2-rpm-macrosUpgrade python2-jinja2Upgrade python2-coverage-debuginfoUpgrade python2-chardetUpgrade python-nose-docs | Nov 6, 2019 | Jan 16, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade numpy-f2pyUpgrade numpy | Nov 3, 2020 | Jan 16, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade numpy-f2pyUpgrade numpy | Sep 28, 2020 | Jan 16, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade numpy-f2pyUpgrade numpy | Mar 24, 2020 | Jan 16, 2019 |
| Oracle_linux | — | Upgrade python2-wheelUpgrade python3-numpy-f2pyUpgrade python2-urllib3Upgrade python-psycopg2-docUpgrade python2-jinja2Upgrade python2-setuptools-wheelUpgrade python2-rpm-macrosUpgrade python2-wheel-wheelUpgrade python2-noseUpgrade python3-numpyUpgrade python2-numpy-f2pyUpgrade python2-psycopg2-testsUpgrade python2-psycopg2-debugUpgrade python2-backports-ssl_match_hostnameUpgrade python2-sixUpgrade python2-mockUpgrade python2-pipUpgrade python2-babelUpgrade python2-chardetUpgrade python2-pyyamlUpgrade python-nose-docsUpgrade python2-ipaddressUpgrade python2Upgrade babelUpgrade python2-toolsUpgrade python2-sqlalchemyUpgrade python2-docsUpgrade python2-pytest-mockUpgrade python2-docutilsUpgrade python2-idnaUpgrade python2-debugUpgrade python2-requestsUpgrade python2-PyMySQLUpgrade python2-pluggyUpgrade python2-bsonUpgrade python2-pysocksUpgrade python2-testUpgrade python2-pymongo-gridfsUpgrade python2-psycopg2Upgrade python2-numpy-docUpgrade python2-numpyUpgrade python2-lxmlUpgrade python2-pymongoUpgrade python2-setuptoolsUpgrade python2-attrsUpgrade python2-pyUpgrade python2-backportsUpgrade python2-tkinterUpgrade python2-setuptools_scmUpgrade python2-pip-wheelUpgrade python-sqlalchemy-docUpgrade python2-libsUpgrade python2-funcsigsUpgrade python2-pytestUpgrade python2-scipyUpgrade python2-develUpgrade python2-dnsUpgrade python2-coverageUpgrade python2-pytzUpgrade python2-markupsafeUpgrade python2-pygmentsUpgrade python2-docs-infoUpgrade python2-virtualenvUpgrade python2-Cython | Oct 5, 2022 | Jan 16, 2019 |
| Redhat_linux | — | Upgrade python-psycopg2-debugsourceUpgrade babelUpgrade python2-psycopg2Upgrade python-nose-docsUpgrade python-psycopg2-docUpgrade Cython-debugsourceUpgrade python2-PyMySQLUpgrade python2-toolsUpgrade python2-libsUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-scipyUpgrade python2-CythonUpgrade python2-bson-debuginfoUpgrade python-psycopg2-debuginfoUpgrade python2-debugUpgrade python2-ipaddressUpgrade python2-docsUpgrade python2-pymongo-debuginfoUpgrade python2-lxml-debuginfoUpgrade python2-Cython-debuginfoUpgrade python2-numpy-f2pyUpgrade python2-setuptools-wheelUpgrade python2-docutilsUpgrade python2-noseUpgrade python2-coverageUpgrade python2-pyyamlUpgrade python2-pyyaml-debuginfoUpgrade python3-numpy-f2pyUpgrade python-pymongo-debugsourceUpgrade python2-idnaUpgrade python2-pluggyUpgrade python2-chardetUpgrade python2-pytest-mockUpgrade python2-psycopg2-testsUpgrade python2-rpm-macrosUpgrade python2-pipUpgrade python2-develUpgrade python-pymongo-debuginfoUpgrade python2-numpy-debuginfoUpgrade python2-sixUpgrade python-lxml-debugsourceUpgrade python2-debugsourceUpgrade python2-scipy-debuginfoUpgrade python2-babelUpgrade python3-numpyUpgrade python2-pymongo-gridfsUpgrade python2-setuptools_scmUpgrade python2-pip-wheelUpgrade python2-testUpgrade python2-tkinterUpgrade python2Upgrade PyYAML-debugsourceUpgrade python2-pyUpgrade python2-jinja2Upgrade python-sqlalchemy-docUpgrade python2-virtualenvNo solution existsUpgrade python2-docs-infoUpgrade python-coverage-debugsourceUpgrade python2-debuginfoUpgrade scipy-debugsourceUpgrade python2-numpyUpgrade python2-setuptoolsUpgrade python2-attrsUpgrade python2-psycopg2-debugUpgrade python2-pytzUpgrade python2-pymongoUpgrade python2-bsonUpgrade python2-funcsigsUpgrade python2-pytestUpgrade python2-lxmlUpgrade python2-markupsafeUpgrade numpy-debugsourceUpgrade python2-mockUpgrade python2-psycopg2-debuginfoUpgrade python2-wheel-wheelUpgrade python2-pysocksUpgrade python2-urllib3Upgrade python2-dnsUpgrade python2-backports-ssl_match_hostnameUpgrade python2-numpy-docUpgrade python2-pygmentsUpgrade python2-sqlalchemyUpgrade python2-backportsUpgrade python2-requestsUpgrade python2-coverage-debuginfoUpgrade python2-wheelUpgrade python3-numpy-debuginfo | Nov 6, 2019 | Jan 16, 2019 |
| Rocky_linux | — | Upgrade python2-scipyUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-pyyaml-debuginfoUpgrade python2-bson-debuginfoUpgrade python2-scipy-debuginfoUpgrade python2-pymongo-debuginfoUpgrade python2-markupsafeUpgrade python2-CythonUpgrade PyYAML-debugsourceUpgrade python-psycopg2-debuginfoUpgrade python2-pyyamlUpgrade python2-bsonUpgrade python-psycopg2-debugsourceUpgrade python-pymongo-debuginfoUpgrade python3-numpy-f2pyUpgrade python-coverage-debugsourceUpgrade python2-psycopg2-debugUpgrade python-pymongo-debugsourceUpgrade scipy-debugsourceUpgrade python2-coverage-debuginfoUpgrade python3-numpyUpgrade python2-pymongo-gridfsUpgrade python2-psycopg2-testsUpgrade python2-coverageUpgrade python2-psycopg2Upgrade python2-Cython-debuginfoUpgrade python3-numpy-debuginfoUpgrade python-psycopg2-docUpgrade Cython-debugsourceUpgrade python2-pymongoUpgrade python2-psycopg2-debuginfo | Mar 12, 2024 | Jan 16, 2019 |
| Suse | — | Upgrade python3-numpy-gnu-hpcUpgrade python3-numpy_1_16_1-gnu-hpcUpgrade python2-numpy_1_14_0-gnu-hpc-develUpgrade python2-numpy_1_16_1-gnu-hpcUpgrade python2-numpy_1_14_0-gnu-hpcUpgrade python3-numpy_1_13_3-gnu-hpcUpgrade python3-numpy_1_14_0-gnu-hpcUpgrade python3-numpy-gnu-hpc-develUpgrade python3-numpy_1_13_3-gnu-hpc-develUpgrade python-numpy-develUpgrade python2-numpy-gnu-hpc-develUpgrade python-numpyUpgrade python2-numpyUpgrade python-numpy_1_13_3-gnu-hpc-develUpgrade python2-numpy-gnu-hpcUpgrade python3-numpy_1_14_0-gnu-hpc-develUpgrade python3-numpy_1_16_1-gnu-hpc-develUpgrade python3-numpyUpgrade python3-numpy-develUpgrade python2-numpy-develUpgrade python-numpy_1_13_3-gnu-hpcUpgrade python2-numpy_1_16_1-gnu-hpc-devel | Feb 13, 2019 | Jan 16, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub