You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@beam.apache.org by "Chamikara Madhusanka Jayalath (Jira)" <ji...@apache.org> on 2022/03/03 18:50:00 UTC

[jira] [Updated] (BEAM-14025) CVE-2021-41496 vulnerability in numpy library

     [ https://issues.apache.org/jira/browse/BEAM-14025?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Chamikara Madhusanka Jayalath updated BEAM-14025:
-------------------------------------------------
    Status: Open  (was: Triage Needed)

> CVE-2021-41496 vulnerability in numpy library
> ---------------------------------------------
>
>                 Key: BEAM-14025
>                 URL: https://issues.apache.org/jira/browse/BEAM-14025
>             Project: Beam
>          Issue Type: Bug
>          Components: dependencies, sdk-py-core
>    Affects Versions: 2.36.0
>            Reporter: Mohinuddin
>            Priority: P2
>              Labels: security
>
> [https://cve.report/CVE-2021-41496]
> Potential buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values. NOTE: The vendor does not agree this is a vulnerability; the negative dimensions can only be created by an already privileged user (or internally).
> Fix: As a fix, the current numpy library version needs to be upgraded to 1.22.x



--
This message was sent by Atlassian Jira
(v8.20.1#820001)