Your submission was sent successfully! Close

You have successfully unsubscribed! Close

CVE-2021-41495

Published: 17 December 2021

** DISPUTED ** Null Pointer Dereference vulnerability exists in numpy.sort in NumPy &lt and 1.19 in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays. NOTE: While correct that validation is missing, an error can only occur due to an exhaustion of memory. If the user can exhaust memory, they are already privileged. Further, it should be practically impossible to construct an attack which can target the memory exhaustion to occur at exactly this place.

Priority

Medium

CVSS 3 base score: 5.3

Status

Package Release Status
numpy
Launchpad, Ubuntu, Debian
focal
Released (1:1.17.4-5ubuntu3.1)
hirsute Ignored
(reached end-of-life)
impish Ignored
(reached end-of-life)
jammy
Released (1:1.21.5-1ubuntu22.04.1)
kinetic
Released (1:1.21.5-1ubuntu22.10.1)
trusty Ignored
(out of standard support)
upstream
Released (1.22.2, 1.23.0)
xenial Ignored
(out of standard support)