An issue was discovered in NumPy before 1.16.3. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior that might have legitimate applications in (for example) loading serialized Python object arrays from trusted and authenticated sources.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python2-idnaUpgrade python2-pyyamlUpgrade python2-docs-infoUpgrade python2-pyUpgrade python2-chardetUpgrade python2-pluggyUpgrade python-psycopg2-docUpgrade python2-pytzUpgrade python2-markupsafeUpgrade python2-attrsUpgrade python2-psycopg2Upgrade python2-setuptools_scmUpgrade python2-rpm-macrosUpgrade python2-pysocksUpgrade python2-pytestUpgrade python2-PyMySQLUpgrade python2-pytest-mockUpgrade python2-mockUpgrade python2-psycopg2-debugUpgrade python2-coverageUpgrade python2-docsUpgrade python2-CythonUpgrade python2-funcsigsUpgrade python2-ipaddressUpgrade python2-psycopg2-testsUpgrade python2-docutilsUpgrade python2-dns | May 4, 2022 | Jan 16, 2019 |
| Centos_linux | — | Upgrade python2-develUpgrade python2-pytest-mockUpgrade python2-attrsUpgrade python2-pymongo-gridfsUpgrade python2-bson-debuginfoUpgrade Cython-debugsourceUpgrade python2-ipaddressUpgrade python2-pymongoUpgrade python2-docutilsUpgrade python2-sqlalchemyUpgrade python2-numpyUpgrade python2-funcsigsUpgrade python2-debugsourceUpgrade python2-backportsUpgrade python2-psycopg2Upgrade python2-psycopg2-debug-debuginfoUpgrade python2-dnsUpgrade python2-setuptoolsUpgrade python2-libsUpgrade python2-toolsUpgrade python2-pysocksUpgrade python2-pyyaml-debuginfoUpgrade python2-pytestUpgrade python2-tkinterUpgrade python2-pymongo-debuginfoUpgrade python2-docsUpgrade python-sqlalchemy-docUpgrade python2-docs-infoUpgrade python2Upgrade python2-bsonUpgrade python2-CythonUpgrade python2-numpy-debuginfoUpgrade python2-pyUpgrade python2-pip-wheelUpgrade python2-numpy-docUpgrade python2-scipyUpgrade python2-pluggyUpgrade python2-pygmentsUpgrade python2-PyMySQLUpgrade python2-debugUpgrade python2-coverageUpgrade babelUpgrade python2-scipy-debuginfoUpgrade python2-setuptools_scmUpgrade python2-virtualenvUpgrade python-pymongo-debuginfoUpgrade python2-idnaUpgrade python2-testUpgrade python2-requestsUpgrade python2-lxmlUpgrade python2-markupsafeUpgrade python2-lxml-debuginfoUpgrade python2-urllib3Upgrade python2-wheelUpgrade python2-psycopg2-testsUpgrade python2-mockUpgrade python2-psycopg2-debugUpgrade python2-debuginfoUpgrade python-psycopg2-debuginfoUpgrade python2-setuptools-wheelUpgrade python2-noseUpgrade python2-jinja2Upgrade PyYAML-debugsourceUpgrade python2-babelUpgrade python2-pipUpgrade python-lxml-debugsourceUpgrade python3-numpy-debuginfoUpgrade numpy-debugsourceUpgrade python2-pyyamlUpgrade python-coverage-debugsourceUpgrade python3-numpy-f2pyUpgrade python2-pytzUpgrade python2-numpy-f2pyUpgrade python2-rpm-macrosUpgrade python2-chardetUpgrade python2-coverage-debuginfoUpgrade python-psycopg2-docUpgrade python2-psycopg2-debuginfoUpgrade scipy-debugsourceUpgrade python2-backports-ssl_match_hostnameUpgrade python-pymongo-debugsourceUpgrade python2-Cython-debuginfoUpgrade python2-wheel-wheelUpgrade python3-numpyUpgrade python2-sixUpgrade python-nose-docsUpgrade python-psycopg2-debugsource | Nov 6, 2019 | Jan 16, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade numpyUpgrade numpy-f2py | Nov 3, 2020 | Jan 16, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade numpyUpgrade numpy-f2py | Sep 28, 2020 | Jan 16, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade numpyUpgrade numpy-f2py | Mar 24, 2020 | Jan 16, 2019 |
| Oracle_linux | — | Upgrade python2-pipUpgrade python2-babelUpgrade python2-mockUpgrade python2-psycopg2-debugUpgrade python2-setuptools-wheelUpgrade python2-pyyamlUpgrade python-nose-docsUpgrade python2-wheel-wheelUpgrade python2-numpy-f2pyUpgrade python2-backports-ssl_match_hostnameUpgrade python2-rpm-macrosUpgrade python3-numpyUpgrade python2-psycopg2-testsUpgrade python2-chardetUpgrade python2-noseUpgrade python2-sixUpgrade python3-numpy-f2pyUpgrade python-psycopg2-docUpgrade python2-jinja2Upgrade python2-urllib3Upgrade python2-wheelUpgrade python2-debugUpgrade python2-pymongoUpgrade python2-requestsUpgrade python2-docsUpgrade python2-pysocksUpgrade python2-setuptoolsUpgrade python2-pyUpgrade python2-idnaUpgrade python2-backportsUpgrade python2-attrsUpgrade babelUpgrade python2-virtualenvUpgrade python2-CythonUpgrade python2-coverageUpgrade python2-pygmentsUpgrade python2-pymongo-gridfsUpgrade python2-psycopg2Upgrade python2-numpyUpgrade python2-lxmlUpgrade python2-ipaddressUpgrade python2-bsonUpgrade python2-docs-infoUpgrade python2-pytzUpgrade python2-numpy-docUpgrade python2-PyMySQLUpgrade python2-scipyUpgrade python2-markupsafeUpgrade python2-pytestUpgrade python2-libsUpgrade python-sqlalchemy-docUpgrade python2-tkinterUpgrade python2-setuptools_scmUpgrade python2-pytest-mockUpgrade python2-pip-wheelUpgrade python2-funcsigsUpgrade python2-docutilsUpgrade python2Upgrade python2-toolsUpgrade python2-sqlalchemyUpgrade python2-testUpgrade python2-dnsUpgrade python2-develUpgrade python2-pluggy | Oct 5, 2022 | Jan 16, 2019 |
| Redhat_linux | — | Upgrade python2-rpm-macrosUpgrade python2-numpy-debuginfoUpgrade python2-bson-debuginfoUpgrade python2-chardetUpgrade python3-numpy-f2pyUpgrade python2-PyMySQLUpgrade python2-docutilsUpgrade python2-CythonUpgrade python-psycopg2-debuginfoUpgrade python-pymongo-debuginfoUpgrade python-lxml-debugsourceUpgrade python2-pymongo-debuginfoUpgrade python2-psycopg2-testsUpgrade python2-docsUpgrade python2-develUpgrade babelUpgrade python2-idnaUpgrade python2-pytest-mockUpgrade python2-Cython-debuginfoUpgrade python2-scipyUpgrade python2-babelUpgrade python2-debugUpgrade python-nose-docsUpgrade python2-psycopg2Upgrade python2-toolsUpgrade python2-scipy-debuginfoUpgrade python-pymongo-debugsourceUpgrade python2-noseUpgrade python2-pluggyUpgrade python2-pyyaml-debuginfoUpgrade python2-libsUpgrade python2-debugsourceUpgrade python3-numpyUpgrade python2-sixUpgrade python2-lxml-debuginfoUpgrade python2-pipUpgrade python2-ipaddressUpgrade python-psycopg2-debugsourceUpgrade python2-coverageUpgrade python2-pyyamlUpgrade python-psycopg2-docUpgrade python2-setuptools-wheelUpgrade Cython-debugsourceUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-numpy-f2pyUpgrade python2-pytestUpgrade python2-requestsUpgrade python2-mockUpgrade python2-backports-ssl_match_hostnameUpgrade python2-pyNo solution existsUpgrade numpy-debugsourceUpgrade python2-sqlalchemyUpgrade python2-markupsafeUpgrade python2-lxmlUpgrade python2-pygmentsUpgrade python2-dnsUpgrade python2-urllib3Upgrade python2-tkinterUpgrade python2Upgrade python2-psycopg2-debugUpgrade python2-funcsigsUpgrade python2-setuptools_scmUpgrade python-sqlalchemy-docUpgrade python2-jinja2Upgrade python2-psycopg2-debuginfoUpgrade python2-testUpgrade python2-pip-wheelUpgrade python2-wheel-wheelUpgrade python2-debuginfoUpgrade python2-numpyUpgrade scipy-debugsourceUpgrade python2-wheelUpgrade python2-numpy-docUpgrade python2-pymongo-gridfsUpgrade PyYAML-debugsourceUpgrade python2-docs-infoUpgrade python2-attrsUpgrade python2-bsonUpgrade python2-setuptoolsUpgrade python2-pymongoUpgrade python2-coverage-debuginfoUpgrade python-coverage-debugsourceUpgrade python2-pytzUpgrade python2-virtualenvUpgrade python2-pysocksUpgrade python3-numpy-debuginfoUpgrade python2-backports | Nov 6, 2019 | Jan 16, 2019 |
| Rocky_linux | — | Upgrade python2-scipy-debuginfoUpgrade python2-bson-debuginfoUpgrade python2-scipyUpgrade PyYAML-debugsourceUpgrade python-psycopg2-debuginfoUpgrade python2-CythonUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-pyyaml-debuginfoUpgrade python2-pyyamlUpgrade python2-markupsafeUpgrade python2-pymongo-debuginfoUpgrade python-psycopg2-docUpgrade python-pymongo-debuginfoUpgrade python2-coverageUpgrade python2-psycopg2-debugUpgrade python-pymongo-debugsourceUpgrade python2-pymongoUpgrade python2-psycopg2-debuginfoUpgrade python-coverage-debugsourceUpgrade python2-bsonUpgrade python-psycopg2-debugsourceUpgrade python3-numpy-f2pyUpgrade python3-numpy-debuginfoUpgrade Cython-debugsourceUpgrade python2-pymongo-gridfsUpgrade scipy-debugsourceUpgrade python3-numpyUpgrade python2-psycopg2-testsUpgrade python2-Cython-debuginfoUpgrade python2-psycopg2Upgrade python2-coverage-debuginfo | Mar 12, 2024 | Jan 16, 2019 |
| Suse | — | Upgrade python3-numpy_1_16_1-gnu-hpcUpgrade python3-numpy-gnu-hpc-develUpgrade python3-numpy_1_13_3-gnu-hpc-develUpgrade python2-numpy_1_14_0-gnu-hpc-develUpgrade python3-numpy_1_13_3-gnu-hpcUpgrade python2-numpy_1_14_0-gnu-hpcUpgrade python3-numpy-gnu-hpcUpgrade python2-numpy_1_16_1-gnu-hpcUpgrade python3-numpy_1_14_0-gnu-hpcUpgrade python-numpy_1_13_3-gnu-hpcUpgrade python3-numpy_1_14_0-gnu-hpc-develUpgrade python2-numpy_1_16_1-gnu-hpc-develUpgrade python3-numpyUpgrade python2-numpy-develUpgrade python-numpy-develUpgrade python2-numpy-gnu-hpcUpgrade python-numpyUpgrade python2-numpyUpgrade python3-numpy-develUpgrade python3-numpy_1_16_1-gnu-hpc-develUpgrade python-numpy_1_13_3-gnu-hpc-develUpgrade python2-numpy-gnu-hpc-devel | Feb 13, 2019 | Jan 16, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub