Headline
Red Hat Security Advisory 2022-8861-01
Red Hat Security Advisory 2022-8861-01 - A fast multidimensional array facility for Python. Issues addressed include a null pointer vulnerability.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Moderate: Red Hat OpenStack Platform 16.1.9 (numpy) security update
Advisory ID: RHSA-2022:8861-01
Product: Red Hat OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2022:8861
Issue date: 2022-12-07
CVE Names: CVE-2021-41495
====================================================================
- Summary:
An update for numpy is now available for Red Hat OpenStack Platform 16.1.9
(Train) for Red Hat Enterprise Linux (RHEL) 8.2.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat OpenStack Platform 16.1 - ppc64le, x86_64
- Description:
A fast multidimensional array facility for Python
Security Fix(es):
- NULL pointer dereference in numpy.sort in the PyArray_DescrNew() due
to missing return-value validation (CVE-2021-41495)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.
- Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
2035037 - CVE-2021-41495 numpy: NULL pointer dereference in numpy.sort in in the PyArray_DescrNew() due to missing return-value validation
- Package List:
Red Hat OpenStack Platform 16.1:
Source:
numpy-1.17.0-11.el8ost.src.rpm
ppc64le:
numpy-debugsource-1.17.0-11.el8ost.ppc64le.rpm
python3-numpy-1.17.0-11.el8ost.ppc64le.rpm
python3-numpy-debuginfo-1.17.0-11.el8ost.ppc64le.rpm
python3-numpy-f2py-1.17.0-11.el8ost.ppc64le.rpm
x86_64:
numpy-debugsource-1.17.0-11.el8ost.x86_64.rpm
python3-numpy-1.17.0-11.el8ost.x86_64.rpm
python3-numpy-debuginfo-1.17.0-11.el8ost.x86_64.rpm
python3-numpy-f2py-1.17.0-11.el8ost.x86_64.rpm
Red Hat OpenStack Platform 16.1:
Source:
numpy-1.17.0-11.el8ost.src.rpm
ppc64le:
numpy-debugsource-1.17.0-11.el8ost.ppc64le.rpm
python3-numpy-1.17.0-11.el8ost.ppc64le.rpm
python3-numpy-debuginfo-1.17.0-11.el8ost.ppc64le.rpm
python3-numpy-f2py-1.17.0-11.el8ost.ppc64le.rpm
x86_64:
numpy-debugsource-1.17.0-11.el8ost.x86_64.rpm
python3-numpy-1.17.0-11.el8ost.x86_64.rpm
python3-numpy-debuginfo-1.17.0-11.el8ost.x86_64.rpm
python3-numpy-f2py-1.17.0-11.el8ost.x86_64.rpm
Red Hat OpenStack Platform 16.1:
Source:
numpy-1.17.0-11.el8ost.src.rpm
ppc64le:
numpy-debugsource-1.17.0-11.el8ost.ppc64le.rpm
python3-numpy-1.17.0-11.el8ost.ppc64le.rpm
python3-numpy-debuginfo-1.17.0-11.el8ost.ppc64le.rpm
python3-numpy-f2py-1.17.0-11.el8ost.ppc64le.rpm
x86_64:
numpy-debugsource-1.17.0-11.el8ost.x86_64.rpm
python3-numpy-1.17.0-11.el8ost.x86_64.rpm
python3-numpy-debuginfo-1.17.0-11.el8ost.x86_64.rpm
python3-numpy-f2py-1.17.0-11.el8ost.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2021-41495
https://access.redhat.com/security/updates/classification/#moderate
- Contact:
The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBY5FpXdzjgjWX9erEAQjuAw/+J98PzX9ebz5l8WTTGG3bmYmCqjOSjyoz
i0HhluPaACP2yC7ZlP8KHE9r/CHkkpwmbd4X4vXfROglNTT1PW7Pn2n5Cbl++XFJ
hYstYrnUR6+xOyM/g+IaXbR1MRE6Zc3SHRI0Z0iEGFA1tPsZ2SM1PhAO5bFAr3iP
JNubTl0Qi20oB9xRICU9HJl54O4RoV4MtqBUbsXGJ1b6ikOEZ1M3QrSuXiij5T6S
oeb+1yUo8BIpByY11rBHucWtq7NuLSqW45DMKkAIBIaWbnq4a/4RtgHDl4EfmqNe
fZioM3IU/SS866iv//+Aunt0XjihO+nX3F9kwC9vYoVfQAO0yRJHT7ng4GVzICrU
uQEFbMPBznLG7UG9R80jXYy0gP44IEOiz0980A3Khg/4MzSOXDleAF3CqL29RUv0
uQElZrf4waixRHRVns7m83vWXULEoYKegYNertukErUFlbjYCHNXbsvdRjMBDIwn
OGNzFiUspgQgDIDIesFGHHtGqbC0S+ZhXLIjJT3xoL3Hb2xv0sW0vZyF6IrjP0UL
oauNs+YFaNoiQ7ZMvyKBOKd31lN6x1kNh8gKv2/qzZX/xjfl8N7ZNv0Fvutnt02Z
oNFrTMb1z7FFZkglHojw9LOysneVs6MVaf1QXaMXG+1yGtNamKMEFTE1YzU0/iBV
mueR1vvOOPE=DHF9
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Related news
Red Hat Security Advisory 2022-8852-01 - A fast multidimensional array facility for Python. Issues addressed include a null pointer vulnerability.
An update for numpy is now available for Red Hat OpenStack Platform 16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-41495: numpy: NULL pointer dereference in numpy.sort in in the PyArray_DescrNew() due to missing return-value validation
An update for numpy is now available for Red Hat OpenStack Platform 16.2.4 (Train) for Red Hat Enterprise Linux (RHEL) 8.4. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-41495: numpy: NULL pointer dereference in numpy.sort in in the PyArray_DescrNew() due to missing return-value validation
Ubuntu Security Notice 5763-1 - It was discovered that NumPy did not properly manage memory when specifying arrays of large dimensions. If a user were tricked into running malicious Python file, an attacker could cause a denial of service. This issue only affected Ubuntu 20.04 LTS. It was discovered that NumPy did not properly perform string comparison operations under certain circumstances. An attacker could possibly use this issue to cause NumPy to crash, resulting in a denial of service.
Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is affected is 14.5. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Trade Finance. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Banking Trade Finance accessible data as well as unauthorized access to critical data or complete access to all Oracle Banking Trade Finance accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N).
** DISPUTED ** Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values. NOTE: The vendor does not agree this is a vulnerability; the negative dimensions can only be created by an already privileged user (or internally).
An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."