Security
Headlines
HeadlinesLatestCVEs

Headline

RHSA-2022:8861: Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.9 (numpy) security update

An update for numpy is now available for Red Hat OpenStack Platform 16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

  • CVE-2021-41495: numpy: NULL pointer dereference in numpy.sort in in the PyArray_DescrNew() due to missing return-value validation
Red Hat Security Data
#vulnerability#web#linux#red_hat#nodejs#js#java#kubernetes#aws#ibm

Skip to navigation Skip to main content

Utilities

  • Subscriptions
  • Downloads
  • Containers
  • Support Cases

Infrastructure and Management

  • Red Hat Enterprise Linux
  • Red Hat Virtualization
  • Red Hat Identity Management
  • Red Hat Directory Server
  • Red Hat Certificate System
  • Red Hat Satellite
  • Red Hat Subscription Management
  • Red Hat Update Infrastructure
  • Red Hat Insights
  • Red Hat Ansible Automation Platform

Cloud Computing

  • Red Hat OpenShift
  • Red Hat CloudForms
  • Red Hat OpenStack Platform
  • Red Hat OpenShift Container Platform
  • Red Hat OpenShift Data Science
  • Red Hat OpenShift Online
  • Red Hat OpenShift Dedicated
  • Red Hat Advanced Cluster Security for Kubernetes
  • Red Hat Advanced Cluster Management for Kubernetes
  • Red Hat Quay
  • OpenShift Dev Spaces
  • Red Hat OpenShift Service on AWS

Storage

  • Red Hat Gluster Storage
  • Red Hat Hyperconverged Infrastructure
  • Red Hat Ceph Storage
  • Red Hat OpenShift Data Foundation

Runtimes

  • Red Hat Runtimes
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat Data Grid
  • Red Hat JBoss Web Server
  • Red Hat Single Sign On
  • Red Hat support for Spring Boot
  • Red Hat build of Node.js
  • Red Hat build of Thorntail
  • Red Hat build of Eclipse Vert.x
  • Red Hat build of OpenJDK
  • Red Hat build of Quarkus

Integration and Automation

  • Red Hat Process Automation
  • Red Hat Process Automation Manager
  • Red Hat Decision Manager

All Products

Issued:

2022-12-07

Updated:

2022-12-07

RHSA-2022:8861 - Security Advisory

  • Overview
  • Updated Packages

Synopsis

Moderate: Red Hat OpenStack Platform 16.1.9 (numpy) security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for numpy is now available for Red Hat OpenStack Platform 16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

Description

A fast multidimensional array facility for Python

Security Fix(es):

  • NULL pointer dereference in numpy.sort in the PyArray_DescrNew() due

to missing return-value validation (CVE-2021-41495)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.

Affected Products

  • Red Hat OpenStack for IBM Power 16.1 ppc64le
  • Red Hat OpenStack 16.1 x86_64
  • Red Hat OpenStack Director Deployment Tools 16.1 x86_64
  • Red Hat OpenStack Director Deployment Tools for IBM Power LE 16.1 ppc64le
  • Cinderlib 16.1 x86_64
  • Cinderlib for IBM Power LE 16.1 ppc64le

Fixes

  • BZ - 2035037 - CVE-2021-41495 numpy: NULL pointer dereference in numpy.sort in in the PyArray_DescrNew() due to missing return-value validation

Red Hat OpenStack for IBM Power 16.1

SRPM

numpy-1.17.0-11.el8ost.src.rpm

SHA-256: fca21e21aa26b8cf8cdd7eadead6b5f2d590b24beffd4f7fdafe7fec6792ccdb

ppc64le

numpy-debugsource-1.17.0-11.el8ost.ppc64le.rpm

SHA-256: dbcb3c14599efa03a77feaf8a50eff15e4d6613ebd4d7c4d2798f37932fbd133

python3-numpy-1.17.0-11.el8ost.ppc64le.rpm

SHA-256: 24821931299b491fc30679a8f4034007d103796b6432ec41ea85ce1e29019209

python3-numpy-debuginfo-1.17.0-11.el8ost.ppc64le.rpm

SHA-256: 87700b15e3f37f1f7a016a57c270ea79792dba20e1591ba5647a579f5243d5ea

python3-numpy-f2py-1.17.0-11.el8ost.ppc64le.rpm

SHA-256: 98bda4b39ab2384976a6e366a18aa6eda9de4d54f7d04b3a47a1e994eb584921

Red Hat OpenStack 16.1

SRPM

numpy-1.17.0-11.el8ost.src.rpm

SHA-256: fca21e21aa26b8cf8cdd7eadead6b5f2d590b24beffd4f7fdafe7fec6792ccdb

x86_64

numpy-debugsource-1.17.0-11.el8ost.x86_64.rpm

SHA-256: 78900f1b5928a94e0129741cd483a3f2446984e2d2c952cc73fe97bb2cff69a9

python3-numpy-1.17.0-11.el8ost.x86_64.rpm

SHA-256: ac92b902c6222337f1aa21b64ed8f2ab2999eca93f58497ec693a2eab45393bc

python3-numpy-debuginfo-1.17.0-11.el8ost.x86_64.rpm

SHA-256: 329d62855cb5e8c6a929f27c2e939e0a19ca20db0613590e42e403f8dc3f6e48

python3-numpy-f2py-1.17.0-11.el8ost.x86_64.rpm

SHA-256: d803cbc930ad49bf1083140163dc8252131612c5959b64dc36facea7ec10711d

Red Hat OpenStack Director Deployment Tools 16.1

SRPM

numpy-1.17.0-11.el8ost.src.rpm

SHA-256: fca21e21aa26b8cf8cdd7eadead6b5f2d590b24beffd4f7fdafe7fec6792ccdb

x86_64

numpy-debugsource-1.17.0-11.el8ost.x86_64.rpm

SHA-256: 78900f1b5928a94e0129741cd483a3f2446984e2d2c952cc73fe97bb2cff69a9

python3-numpy-1.17.0-11.el8ost.x86_64.rpm

SHA-256: ac92b902c6222337f1aa21b64ed8f2ab2999eca93f58497ec693a2eab45393bc

python3-numpy-debuginfo-1.17.0-11.el8ost.x86_64.rpm

SHA-256: 329d62855cb5e8c6a929f27c2e939e0a19ca20db0613590e42e403f8dc3f6e48

python3-numpy-f2py-1.17.0-11.el8ost.x86_64.rpm

SHA-256: d803cbc930ad49bf1083140163dc8252131612c5959b64dc36facea7ec10711d

Red Hat OpenStack Director Deployment Tools for IBM Power LE 16.1

SRPM

numpy-1.17.0-11.el8ost.src.rpm

SHA-256: fca21e21aa26b8cf8cdd7eadead6b5f2d590b24beffd4f7fdafe7fec6792ccdb

ppc64le

numpy-debugsource-1.17.0-11.el8ost.ppc64le.rpm

SHA-256: dbcb3c14599efa03a77feaf8a50eff15e4d6613ebd4d7c4d2798f37932fbd133

python3-numpy-1.17.0-11.el8ost.ppc64le.rpm

SHA-256: 24821931299b491fc30679a8f4034007d103796b6432ec41ea85ce1e29019209

python3-numpy-debuginfo-1.17.0-11.el8ost.ppc64le.rpm

SHA-256: 87700b15e3f37f1f7a016a57c270ea79792dba20e1591ba5647a579f5243d5ea

python3-numpy-f2py-1.17.0-11.el8ost.ppc64le.rpm

SHA-256: 98bda4b39ab2384976a6e366a18aa6eda9de4d54f7d04b3a47a1e994eb584921

Cinderlib 16.1

SRPM

numpy-1.17.0-11.el8ost.src.rpm

SHA-256: fca21e21aa26b8cf8cdd7eadead6b5f2d590b24beffd4f7fdafe7fec6792ccdb

x86_64

numpy-debugsource-1.17.0-11.el8ost.x86_64.rpm

SHA-256: 78900f1b5928a94e0129741cd483a3f2446984e2d2c952cc73fe97bb2cff69a9

python3-numpy-1.17.0-11.el8ost.x86_64.rpm

SHA-256: ac92b902c6222337f1aa21b64ed8f2ab2999eca93f58497ec693a2eab45393bc

python3-numpy-debuginfo-1.17.0-11.el8ost.x86_64.rpm

SHA-256: 329d62855cb5e8c6a929f27c2e939e0a19ca20db0613590e42e403f8dc3f6e48

python3-numpy-f2py-1.17.0-11.el8ost.x86_64.rpm

SHA-256: d803cbc930ad49bf1083140163dc8252131612c5959b64dc36facea7ec10711d

Cinderlib for IBM Power LE 16.1

SRPM

numpy-1.17.0-11.el8ost.src.rpm

SHA-256: fca21e21aa26b8cf8cdd7eadead6b5f2d590b24beffd4f7fdafe7fec6792ccdb

ppc64le

numpy-debugsource-1.17.0-11.el8ost.ppc64le.rpm

SHA-256: dbcb3c14599efa03a77feaf8a50eff15e4d6613ebd4d7c4d2798f37932fbd133

python3-numpy-1.17.0-11.el8ost.ppc64le.rpm

SHA-256: 24821931299b491fc30679a8f4034007d103796b6432ec41ea85ce1e29019209

python3-numpy-debuginfo-1.17.0-11.el8ost.ppc64le.rpm

SHA-256: 87700b15e3f37f1f7a016a57c270ea79792dba20e1591ba5647a579f5243d5ea

python3-numpy-f2py-1.17.0-11.el8ost.ppc64le.rpm

SHA-256: 98bda4b39ab2384976a6e366a18aa6eda9de4d54f7d04b3a47a1e994eb584921

The Red Hat security contact is [email protected]. More contact details at https://access.redhat.com/security/team/contact/.

Related news

Red Hat Security Advisory 2022-8852-01

Red Hat Security Advisory 2022-8852-01 - A fast multidimensional array facility for Python. Issues addressed include a null pointer vulnerability.

Red Hat Security Advisory 2022-8861-01

Red Hat Security Advisory 2022-8861-01 - A fast multidimensional array facility for Python. Issues addressed include a null pointer vulnerability.

RHSA-2022:8852: Red Hat Security Advisory: Red Hat OpenStack Platform 16.2.4 (numpy) security update

An update for numpy is now available for Red Hat OpenStack Platform 16.2.4 (Train) for Red Hat Enterprise Linux (RHEL) 8.4. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-41495: numpy: NULL pointer dereference in numpy.sort in in the PyArray_DescrNew() due to missing return-value validation

Ubuntu Security Notice USN-5763-1

Ubuntu Security Notice 5763-1 - It was discovered that NumPy did not properly manage memory when specifying arrays of large dimensions. If a user were tricked into running malicious Python file, an attacker could cause a denial of service. This issue only affected Ubuntu 20.04 LTS. It was discovered that NumPy did not properly perform string comparison operations under certain circumstances. An attacker could possibly use this issue to cause NumPy to crash, resulting in a denial of service.

CVE-2022-21587: Oracle Critical Patch Update Advisory - October 2022

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVE-2022-21586: Oracle Critical Patch Update Advisory - July 2022

Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is affected is 14.5. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Trade Finance. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Banking Trade Finance accessible data as well as unauthorized access to critical data or complete access to all Oracle Banking Trade Finance accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N).

CVE-2021-41496: Potential buffer-overflow from string operations in function array_from_pyobj of fortranobject.c · Issue #19000 · numpy/numpy

** DISPUTED ** Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values. NOTE: The vendor does not agree this is a vulnerability; the negative dimensions can only be created by an already privileged user (or internally).

CVE-2021-34141: Insecure string comparison (incomplete comparison) in _convert_from_str of descriptor.c · Issue #18993 · numpy/numpy

An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."