PYSEC-2021-856

At a glance

Published: 2021-12-17 20:15 UTC
Updated: 2023-11-08 04:06 UTC
CVE: CVE-2021-41495
Aliases: GHSA-5545-2q6w-2gh6

Description

Null Pointer Dereference vulnerability exists in numpy.sort in NumPy &lt and 1.19 in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays.

Affected packages

Package	Versions
PyPI · numpy	introduced 0, fixed 1.19.1

References

https://github.com/numpy/numpy/issues/19038 REPORT
https://github.com/advisories/GHSA-5545-2q6w-2gh6 ADVISORY

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — PyPA Advisory Database