Mohinuddin created BEAM-14025:
---------------------------------
Summary: CVE-2021-41496 vulnerability in numpy library
Key: BEAM-14025
URL: https://issues.apache.org/jira/browse/BEAM-14025
Project: Beam
Issue Type: Bug
Components: dependencies, sdk-py-core
Affects Versions: 2.36.0
Reporter: Mohinuddin
[https://cve.report/CVE-2021-41496]
Potential buffer overflow in the array_from_pyobj function of fortranobject.c
in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks
by carefully constructing an array with negative values. NOTE: The vendor does
not agree this is a vulnerability; the negative dimensions can only be created
by an already privileged user (or internally).
Fix: As a fix, the current numpy library version needs to be upgraded to 1.22.x
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
