CVE-2019-6446: Numpy Deserialization of Untrusted Data
(updated )
** DISPUTED ** An issue was discovered in NumPy 1.16.2 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior that might have legitimate applications in (for example) loading serialized Python object arrays from trusted and authenticated sources.
References
- access.redhat.com/errata/RHSA-2019:3335
- access.redhat.com/errata/RHSA-2019:3704
- bugzilla.suse.com/show_bug.cgi?id=1122208
- github.com/advisories/GHSA-9fq2-x9r6-wfmf
- github.com/numpy/numpy/commit/89b688732b37616c9d26623f81aaee1703c30ffb
- github.com/numpy/numpy/issues/12759
- github.com/numpy/numpy/pull/12889
- github.com/numpy/numpy/pull/13359
- github.com/pypa/advisory-database/tree/main/vulns/numpy/PYSEC-2019-108.yaml
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZZAYIQNUUYXGMKHSPEEXS4TRYFOUYE4
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ZZAYIQNUUYXGMKHSPEEXS4TRYFOUYE4
- nvd.nist.gov/vuln/detail/CVE-2019-6446
- web.archive.org/web/20210124234613/https://www.securityfocus.com/bid/106670
Code Behaviors & Features
Detect and mitigate CVE-2019-6446 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →