Headline
RHSA-2022:8852: Red Hat Security Advisory: Red Hat OpenStack Platform 16.2.4 (numpy) security update
An update for numpy is now available for Red Hat OpenStack Platform 16.2.4 (Train) for Red Hat Enterprise Linux (RHEL) 8.4. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Related CVEs:
- CVE-2021-41495: numpy: NULL pointer dereference in numpy.sort in in the PyArray_DescrNew() due to missing return-value validation
Skip to navigation Skip to main content
Utilities
- Subscriptions
- Downloads
- Containers
- Support Cases
Infrastructure and Management
- Red Hat Enterprise Linux
- Red Hat Virtualization
- Red Hat Identity Management
- Red Hat Directory Server
- Red Hat Certificate System
- Red Hat Satellite
- Red Hat Subscription Management
- Red Hat Update Infrastructure
- Red Hat Insights
- Red Hat Ansible Automation Platform
Cloud Computing
- Red Hat OpenShift
- Red Hat CloudForms
- Red Hat OpenStack Platform
- Red Hat OpenShift Container Platform
- Red Hat OpenShift Data Science
- Red Hat OpenShift Online
- Red Hat OpenShift Dedicated
- Red Hat Advanced Cluster Security for Kubernetes
- Red Hat Advanced Cluster Management for Kubernetes
- Red Hat Quay
- OpenShift Dev Spaces
- Red Hat OpenShift Service on AWS
Storage
- Red Hat Gluster Storage
- Red Hat Hyperconverged Infrastructure
- Red Hat Ceph Storage
- Red Hat OpenShift Data Foundation
Runtimes
- Red Hat Runtimes
- Red Hat JBoss Enterprise Application Platform
- Red Hat Data Grid
- Red Hat JBoss Web Server
- Red Hat Single Sign On
- Red Hat support for Spring Boot
- Red Hat build of Node.js
- Red Hat build of Thorntail
- Red Hat build of Eclipse Vert.x
- Red Hat build of OpenJDK
- Red Hat build of Quarkus
Integration and Automation
- Red Hat Process Automation
- Red Hat Process Automation Manager
- Red Hat Decision Manager
All Products
Issued:
2022-12-07
Updated:
2022-12-07
RHSA-2022:8852 - Security Advisory
- Overview
- Updated Packages
Synopsis
Moderate: Red Hat OpenStack Platform 16.2.4 (numpy) security update
Type/Severity
Security Advisory: Moderate
Red Hat Insights patch analysis
Identify and remediate systems affected by this advisory.
View affected systems
Topic
An update for numpy is now available for Red Hat OpenStack Platform 16.2.4 (Train) for Red Hat Enterprise Linux (RHEL) 8.4.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
Description
A fast multidimensional array facility for Python
Security Fix(es):
- NULL pointer dereference in numpy.sort in the PyArray_DescrNew() due
to missing return-value validation (CVE-2021-41495)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.
Affected Products
- Red Hat OpenStack for IBM Power 16.2 ppc64le
- Red Hat OpenStack 16.2 x86_64
- Red Hat OpenStack Director Deployment Tools 16.2 x86_64
- Red Hat OpenStack Director Deployment Tools for IBM Power LE 16.2 ppc64le
- Red Hat Enterprise Linux for x86_64 8 x86_64
- Cinderlib 16.2 x86_64
- Cinderlib for IBM Power LE 16.2 ppc64le
Fixes
- BZ - 2035037 - CVE-2021-41495 numpy: NULL pointer dereference in numpy.sort in in the PyArray_DescrNew() due to missing return-value validation
Red Hat OpenStack for IBM Power 16.2
SRPM
numpy-1.17.0-11.el8ost.src.rpm
SHA-256: fca21e21aa26b8cf8cdd7eadead6b5f2d590b24beffd4f7fdafe7fec6792ccdb
ppc64le
numpy-debugsource-1.17.0-11.el8ost.ppc64le.rpm
SHA-256: dbcb3c14599efa03a77feaf8a50eff15e4d6613ebd4d7c4d2798f37932fbd133
python3-numpy-1.17.0-11.el8ost.ppc64le.rpm
SHA-256: 24821931299b491fc30679a8f4034007d103796b6432ec41ea85ce1e29019209
python3-numpy-debuginfo-1.17.0-11.el8ost.ppc64le.rpm
SHA-256: 87700b15e3f37f1f7a016a57c270ea79792dba20e1591ba5647a579f5243d5ea
python3-numpy-f2py-1.17.0-11.el8ost.ppc64le.rpm
SHA-256: 98bda4b39ab2384976a6e366a18aa6eda9de4d54f7d04b3a47a1e994eb584921
Red Hat OpenStack 16.2
SRPM
numpy-1.17.0-11.el8ost.src.rpm
SHA-256: fca21e21aa26b8cf8cdd7eadead6b5f2d590b24beffd4f7fdafe7fec6792ccdb
x86_64
numpy-debugsource-1.17.0-11.el8ost.x86_64.rpm
SHA-256: 78900f1b5928a94e0129741cd483a3f2446984e2d2c952cc73fe97bb2cff69a9
python3-numpy-1.17.0-11.el8ost.x86_64.rpm
SHA-256: ac92b902c6222337f1aa21b64ed8f2ab2999eca93f58497ec693a2eab45393bc
python3-numpy-debuginfo-1.17.0-11.el8ost.x86_64.rpm
SHA-256: 329d62855cb5e8c6a929f27c2e939e0a19ca20db0613590e42e403f8dc3f6e48
python3-numpy-f2py-1.17.0-11.el8ost.x86_64.rpm
SHA-256: d803cbc930ad49bf1083140163dc8252131612c5959b64dc36facea7ec10711d
Red Hat OpenStack Director Deployment Tools 16.2
SRPM
numpy-1.17.0-11.el8ost.src.rpm
SHA-256: fca21e21aa26b8cf8cdd7eadead6b5f2d590b24beffd4f7fdafe7fec6792ccdb
x86_64
numpy-debugsource-1.17.0-11.el8ost.x86_64.rpm
SHA-256: 78900f1b5928a94e0129741cd483a3f2446984e2d2c952cc73fe97bb2cff69a9
python3-numpy-1.17.0-11.el8ost.x86_64.rpm
SHA-256: ac92b902c6222337f1aa21b64ed8f2ab2999eca93f58497ec693a2eab45393bc
python3-numpy-debuginfo-1.17.0-11.el8ost.x86_64.rpm
SHA-256: 329d62855cb5e8c6a929f27c2e939e0a19ca20db0613590e42e403f8dc3f6e48
python3-numpy-f2py-1.17.0-11.el8ost.x86_64.rpm
SHA-256: d803cbc930ad49bf1083140163dc8252131612c5959b64dc36facea7ec10711d
Red Hat OpenStack Director Deployment Tools for IBM Power LE 16.2
SRPM
numpy-1.17.0-11.el8ost.src.rpm
SHA-256: fca21e21aa26b8cf8cdd7eadead6b5f2d590b24beffd4f7fdafe7fec6792ccdb
ppc64le
numpy-debugsource-1.17.0-11.el8ost.ppc64le.rpm
SHA-256: dbcb3c14599efa03a77feaf8a50eff15e4d6613ebd4d7c4d2798f37932fbd133
python3-numpy-1.17.0-11.el8ost.ppc64le.rpm
SHA-256: 24821931299b491fc30679a8f4034007d103796b6432ec41ea85ce1e29019209
python3-numpy-debuginfo-1.17.0-11.el8ost.ppc64le.rpm
SHA-256: 87700b15e3f37f1f7a016a57c270ea79792dba20e1591ba5647a579f5243d5ea
python3-numpy-f2py-1.17.0-11.el8ost.ppc64le.rpm
SHA-256: 98bda4b39ab2384976a6e366a18aa6eda9de4d54f7d04b3a47a1e994eb584921
Red Hat Enterprise Linux for x86_64 8
SRPM
numpy-1.17.0-11.el8ost.src.rpm
SHA-256: fca21e21aa26b8cf8cdd7eadead6b5f2d590b24beffd4f7fdafe7fec6792ccdb
x86_64
numpy-debugsource-1.17.0-11.el8ost.x86_64.rpm
SHA-256: 78900f1b5928a94e0129741cd483a3f2446984e2d2c952cc73fe97bb2cff69a9
python3-numpy-1.17.0-11.el8ost.x86_64.rpm
SHA-256: ac92b902c6222337f1aa21b64ed8f2ab2999eca93f58497ec693a2eab45393bc
python3-numpy-debuginfo-1.17.0-11.el8ost.x86_64.rpm
SHA-256: 329d62855cb5e8c6a929f27c2e939e0a19ca20db0613590e42e403f8dc3f6e48
python3-numpy-f2py-1.17.0-11.el8ost.x86_64.rpm
SHA-256: d803cbc930ad49bf1083140163dc8252131612c5959b64dc36facea7ec10711d
Cinderlib 16.2
SRPM
numpy-1.17.0-11.el8ost.src.rpm
SHA-256: fca21e21aa26b8cf8cdd7eadead6b5f2d590b24beffd4f7fdafe7fec6792ccdb
x86_64
numpy-debugsource-1.17.0-11.el8ost.x86_64.rpm
SHA-256: 78900f1b5928a94e0129741cd483a3f2446984e2d2c952cc73fe97bb2cff69a9
python3-numpy-1.17.0-11.el8ost.x86_64.rpm
SHA-256: ac92b902c6222337f1aa21b64ed8f2ab2999eca93f58497ec693a2eab45393bc
python3-numpy-debuginfo-1.17.0-11.el8ost.x86_64.rpm
SHA-256: 329d62855cb5e8c6a929f27c2e939e0a19ca20db0613590e42e403f8dc3f6e48
python3-numpy-f2py-1.17.0-11.el8ost.x86_64.rpm
SHA-256: d803cbc930ad49bf1083140163dc8252131612c5959b64dc36facea7ec10711d
Cinderlib for IBM Power LE 16.2
SRPM
numpy-1.17.0-11.el8ost.src.rpm
SHA-256: fca21e21aa26b8cf8cdd7eadead6b5f2d590b24beffd4f7fdafe7fec6792ccdb
ppc64le
numpy-debugsource-1.17.0-11.el8ost.ppc64le.rpm
SHA-256: dbcb3c14599efa03a77feaf8a50eff15e4d6613ebd4d7c4d2798f37932fbd133
python3-numpy-1.17.0-11.el8ost.ppc64le.rpm
SHA-256: 24821931299b491fc30679a8f4034007d103796b6432ec41ea85ce1e29019209
python3-numpy-debuginfo-1.17.0-11.el8ost.ppc64le.rpm
SHA-256: 87700b15e3f37f1f7a016a57c270ea79792dba20e1591ba5647a579f5243d5ea
python3-numpy-f2py-1.17.0-11.el8ost.ppc64le.rpm
SHA-256: 98bda4b39ab2384976a6e366a18aa6eda9de4d54f7d04b3a47a1e994eb584921
The Red Hat security contact is [email protected]. More contact details at https://access.redhat.com/security/team/contact/.
Related news
Red Hat Security Advisory 2022-8852-01 - A fast multidimensional array facility for Python. Issues addressed include a null pointer vulnerability.
Red Hat Security Advisory 2022-8861-01 - A fast multidimensional array facility for Python. Issues addressed include a null pointer vulnerability.
An update for numpy is now available for Red Hat OpenStack Platform 16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-41495: numpy: NULL pointer dereference in numpy.sort in in the PyArray_DescrNew() due to missing return-value validation
Ubuntu Security Notice 5763-1 - It was discovered that NumPy did not properly manage memory when specifying arrays of large dimensions. If a user were tricked into running malicious Python file, an attacker could cause a denial of service. This issue only affected Ubuntu 20.04 LTS. It was discovered that NumPy did not properly perform string comparison operations under certain circumstances. An attacker could possibly use this issue to cause NumPy to crash, resulting in a denial of service.
Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is affected is 14.5. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Trade Finance. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Banking Trade Finance accessible data as well as unauthorized access to critical data or complete access to all Oracle Banking Trade Finance accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N).
** DISPUTED ** Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values. NOTE: The vendor does not agree this is a vulnerability; the negative dimensions can only be created by an already privileged user (or internally).
An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."