Headline
Red Hat Security Advisory 2022-8852-01
Red Hat Security Advisory 2022-8852-01 - A fast multidimensional array facility for Python. Issues addressed include a null pointer vulnerability.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Moderate: Red Hat OpenStack Platform 16.2.4 (numpy) security update
Advisory ID: RHSA-2022:8852-01
Product: Red Hat OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2022:8852
Issue date: 2022-12-07
CVE Names: CVE-2021-41495
====================================================================
- Summary:
An update for numpy is now available for Red Hat OpenStack Platform 16.2.4
(Train) for Red Hat Enterprise Linux (RHEL) 8.4.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat OpenStack Platform 16.2 - ppc64le, x86_64
- Description:
A fast multidimensional array facility for Python
Security Fix(es):
- NULL pointer dereference in numpy.sort in the PyArray_DescrNew() due
to missing return-value validation (CVE-2021-41495)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.
- Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
2035037 - CVE-2021-41495 numpy: NULL pointer dereference in numpy.sort in in the PyArray_DescrNew() due to missing return-value validation
- Package List:
Red Hat OpenStack Platform 16.2:
Source:
numpy-1.17.0-11.el8ost.src.rpm
ppc64le:
numpy-debugsource-1.17.0-11.el8ost.ppc64le.rpm
python3-numpy-1.17.0-11.el8ost.ppc64le.rpm
python3-numpy-debuginfo-1.17.0-11.el8ost.ppc64le.rpm
python3-numpy-f2py-1.17.0-11.el8ost.ppc64le.rpm
x86_64:
numpy-debugsource-1.17.0-11.el8ost.x86_64.rpm
python3-numpy-1.17.0-11.el8ost.x86_64.rpm
python3-numpy-debuginfo-1.17.0-11.el8ost.x86_64.rpm
python3-numpy-f2py-1.17.0-11.el8ost.x86_64.rpm
Red Hat OpenStack Platform 16.2:
Source:
numpy-1.17.0-11.el8ost.src.rpm
ppc64le:
numpy-debugsource-1.17.0-11.el8ost.ppc64le.rpm
python3-numpy-1.17.0-11.el8ost.ppc64le.rpm
python3-numpy-debuginfo-1.17.0-11.el8ost.ppc64le.rpm
python3-numpy-f2py-1.17.0-11.el8ost.ppc64le.rpm
x86_64:
numpy-debugsource-1.17.0-11.el8ost.x86_64.rpm
python3-numpy-1.17.0-11.el8ost.x86_64.rpm
python3-numpy-debuginfo-1.17.0-11.el8ost.x86_64.rpm
python3-numpy-f2py-1.17.0-11.el8ost.x86_64.rpm
Red Hat OpenStack Platform 16.2:
Source:
numpy-1.17.0-11.el8ost.src.rpm
ppc64le:
numpy-debugsource-1.17.0-11.el8ost.ppc64le.rpm
python3-numpy-1.17.0-11.el8ost.ppc64le.rpm
python3-numpy-debuginfo-1.17.0-11.el8ost.ppc64le.rpm
python3-numpy-f2py-1.17.0-11.el8ost.ppc64le.rpm
x86_64:
numpy-debugsource-1.17.0-11.el8ost.x86_64.rpm
python3-numpy-1.17.0-11.el8ost.x86_64.rpm
python3-numpy-debuginfo-1.17.0-11.el8ost.x86_64.rpm
python3-numpy-f2py-1.17.0-11.el8ost.x86_64.rpm
Red Hat OpenStack Platform 16.2:
Source:
numpy-1.17.0-11.el8ost.src.rpm
x86_64:
numpy-debugsource-1.17.0-11.el8ost.x86_64.rpm
python3-numpy-1.17.0-11.el8ost.x86_64.rpm
python3-numpy-debuginfo-1.17.0-11.el8ost.x86_64.rpm
python3-numpy-f2py-1.17.0-11.el8ost.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2021-41495
https://access.redhat.com/security/updates/classification/#moderate
- Contact:
The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBY5FpYNzjgjWX9erEAQhgfg//f83LbU6ItAgUp+zoZFPPbzSk47S195bN
43EB3UOSd4Sf+JCtClkeGgzS05ogVF/7aEuQkpUDAMYplJrv6gxBEy1NKbW3vLOI
/H/Zh3baeXBA9SwT57kah/iLyao4T1QvuIWQXaJRnmtNGftZWHTsldsiBQpCn+/j
JEZx6edutX1I8U2+j4arfd2RqPWG/RnXSEBsuutoTqFz4rLI8igC+lHf9k8EiJe8
N/5h39IUBIveahOj3zV64p4hdatQ3MMjl7cTIgeapnoigSRSPsQmX+5pQ2DPlNlu
5ObBwCsSAmEy2cygPAq2E7/BglaYey3gxUrjPaUSUsX3FmVFaDh+sKzgnr1jS5oq
eX+hToVOehvoDktDJs17Drv+H0xvZwYKZueACEk9oY0zWfl4PShxZqEb9Zj/G4ay
TAoAc8+hAXE51X+INfpfMVvP5pB8y7Yk40+AWfhfojiTl34FsafG3PM8kGhhodr9
p3HYLVVb4UhGgSTIJ+CCz4jhZrmBMYRu4R+kL4p7itZwDUVEs9eScIdHZgrHV4C9
J9BapgqnjNq7wkrkdJFgfVh9E3lCQsOD1mHNDBcEh2PMeiZQLR294PYqspDfYmqd
IAKuP4bz4L28euC0fsHzt6xG+Iya5UqjbkFfrGyqgNo3J0rS9YyTcGsFxtc+bYZi
FD+LO1bgUAQ=7igt
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Related news
Red Hat Security Advisory 2022-8861-01 - A fast multidimensional array facility for Python. Issues addressed include a null pointer vulnerability.
An update for numpy is now available for Red Hat OpenStack Platform 16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-41495: numpy: NULL pointer dereference in numpy.sort in in the PyArray_DescrNew() due to missing return-value validation
An update for numpy is now available for Red Hat OpenStack Platform 16.2.4 (Train) for Red Hat Enterprise Linux (RHEL) 8.4. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-41495: numpy: NULL pointer dereference in numpy.sort in in the PyArray_DescrNew() due to missing return-value validation
Ubuntu Security Notice 5763-1 - It was discovered that NumPy did not properly manage memory when specifying arrays of large dimensions. If a user were tricked into running malicious Python file, an attacker could cause a denial of service. This issue only affected Ubuntu 20.04 LTS. It was discovered that NumPy did not properly perform string comparison operations under certain circumstances. An attacker could possibly use this issue to cause NumPy to crash, resulting in a denial of service.
Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is affected is 14.5. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Trade Finance. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Banking Trade Finance accessible data as well as unauthorized access to critical data or complete access to all Oracle Banking Trade Finance accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N).
** DISPUTED ** Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values. NOTE: The vendor does not agree this is a vulnerability; the negative dimensions can only be created by an already privileged user (or internally).
An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."