CVE-2021-34141

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-34141
An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
https://github.com/numpy/numpy/issues/18993 Exploit Issue Tracking Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Patch Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:numpy:numpy:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.1.3:*:*:*:*:*:*:*
History

24 Feb 2023, 15:35

Type Values Removed Values Added
CPE cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.1.3:*:*:*:*:*:*:*
References (N/A) https://www.oracle.com/security-alerts/cpujul2022.html - (N/A) https://www.oracle.com/security-alerts/cpujul2022.html - Patch, Third Party Advisory

25 Jul 2022, 18:15

Type Values Removed Values Added
References
  • (N/A) https://www.oracle.com/security-alerts/cpujul2022.html -

31 Mar 2022, 17:56

Type Values Removed Values Added
References (MISC) https://github.com/numpy/numpy/issues/18993 - Exploit, Issue Tracking, Third Party Advisory (MISC) https://github.com/numpy/numpy/issues/18993 - Exploit, Issue Tracking, Patch, Third Party Advisory

05 Jan 2022, 16:15

Type Values Removed Values Added
Summary ** DISPUTED ** Incomplete string comparison in the numpy.core component in NumPy1.9.x, which allows attackers to fail the APIs via constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless." An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."

04 Jan 2022, 21:15

Type Values Removed Values Added
Summary Incomplete string comparison in the numpy.core component in NumPy1.9.x, which allows attackers to fail the APIs via constructing specific string objects. ** DISPUTED ** Incomplete string comparison in the numpy.core component in NumPy1.9.x, which allows attackers to fail the APIs via constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."

04 Jan 2022, 17:48

Type Values Removed Values Added
References (MISC) https://github.com/numpy/numpy/issues/18993 - Exploit, Third Party Advisory (MISC) https://github.com/numpy/numpy/issues/18993 - Exploit, Issue Tracking, Third Party Advisory
CVSS v2 : 7.5
v3 : 9.8 		v2 : 5.0
v3 : 5.3

22 Dec 2021, 20:47

Type Values Removed Values Added
CWE CWE-697
CVSS v2 : unknown
v3 : unknown 		v2 : 7.5
v3 : 9.8
References (MISC) https://github.com/numpy/numpy/issues/18993 - (MISC) https://github.com/numpy/numpy/issues/18993 - Exploit, Third Party Advisory
CPE cpe:2.3:a:numpy:numpy:*:*:*:*:*:*:*:*

17 Dec 2021, 19:42

Type Values Removed Values Added
New CVE
Information

Published : 2021-12-17 19:15

Updated : 2024-02-04 22:08

NVD link : CVE-2021-34141

Mitre link : CVE-2021-34141

CVE.ORG link : CVE-2021-34141

JSON object : View

Products Affected

numpy

  • numpy

oracle

  • communications_cloud_native_core_policy
CWE
CWE-697

Incorrect Comparison