CVE-2017-12852

HIGH7.5EPSS 0.81%

Numpy missing input validation

發布日:2022/5/13修改日:2023/11/8

描述

The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.

受影響套件(2)

PyPI/numpyfrom 0, < 1.13.3
PyPI/numpyfrom 0, < 1.13.3

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

參考連結(7)

ADVISORYhttps://github.com/advisories/GHSA-frgw-fgh6-9g52
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2017-12852
PATCHhttps://github.com/numpy/numpy
WEBhttps://github.com/BT123/testcasesForMyRequest/tree/master/CVE-2017-12852
WEBhttps://github.com/numpy/numpy/issues/9560#issuecomment-322395292
WEBhttps://github.com/numpy/numpy/releases/tag/v1.13.3
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/numpy/PYSEC-2017-1.yaml