GitHub Advisoryadvisory · PyPI

GHSA-cw6w-4rcx-xphc Arbitrary file write in NumPy

HIGH Published 2022-05-14 Modified 2024-10-07 Official page ↗
Aliases
CVE-2014-1858
Ecosystem
PyPI
Packages
numpy
Severity
High
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20
Reviewed
2022-06-17

Affected packages

• PyPI numpy: < 1.8.1 → fixed in 1.8.1

Description

__init__.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file.

Related

Alias · CVE (1)

  • CVE-2014-1858 __init__.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References