CVE-2021-41495
NumPy NULL Pointer Dereference
7.5
HIGH
CVSS 3.1
EPSS 1.2%
描述
Null Pointer Dereference vulnerability exists in numpy.sort in NumPy < and 1.19 in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays. NOTE: While correct that validation is missing, an error can only occur due to an exhaustion of memory. If the user can exhaust memory, they are already privileged. Further, it should be practically impossible to construct an attack which can target the memory exhaustion to occur at exactly this place
如何修補 CVE-2021-41495
要修補 CVE-2021-41495,請將受影響套件升級到下列已修補版本。
- —未列出修補版本
- —升級至 1.19 或更新版本
- —升級至 1.19.1 或更新版本
CVE-2021-41495 正在被利用嗎?
低 — EPSS 為 1.2%,目前沒有觀察到大規模利用活動。
受影響套件(3)
- from 0
- from 0, < 1.19
- from 0, < 1.19.1
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |