GitHub Advisoryadvisory · PyPI

GHSA-frgw-fgh6-9g52 Numpy missing input validation

HIGH Published 2022-05-13 Modified 2022-06-17 Official page ↗
Aliases
CVE-2017-12852
Ecosystem
PyPI
Packages
numpy
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-835
Reviewed
2022-06-17

Affected packages

• PyPI numpy: < 1.13.3 → fixed in 1.13.3

Description

The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.

Related

Alias · CVE (1)

  • CVE-2017-12852 The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. vulnerability

Weakness · CWE (1)

  • CWE-835 Loop with Unreachable Exit Condition weakness

References