Lucene search

K
ubuntucveUbuntu.comUB:CVE-2021-33430
HistoryDec 17, 2021 - 12:00 a.m.

CVE-2021-33430

2021-12-1700:00:00
ubuntu.com
ubuntu.com
20
buffer overflow
numpy
pyarray_newfromdescr_int
denial of service
large dimensions
python code
memory exhaustion

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:N/I:N/A:P

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

30.3%

DISPUTED A Buffer Overflow vulnerability exists in NumPy 1.9.x in the
PyArray_NewFromDescr_int function of ctors.c when specifying arrays of
large dimensions (over 32) from Python code, which could let a malicious
user cause a Denial of Service. NOTE: The vendor does not agree this is a
vulneraility; In (very limited) circumstances a user may be able provoke
the buffer overflow, the user is most likely already privileged to at least
provoke denial of service by exhausting memory. Triggering this further
requires the use of uncommon API (complicated structured dtypes), which is
very unlikely to be available to an unprivileged user.

OSVersionArchitecturePackageVersionFilename
ubuntu20.04noarchnumpy< 1:1.17.4-5ubuntu3.1UNKNOWN

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:N/I:N/A:P

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

30.3%