[
https://issues.apache.org/jira/browse/BEAM-14025?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17500977#comment-17500977
]
Chamikara Madhusanka Jayalath commented on BEAM-14025:
------------------------------------------------------
cc: [~hulettbh] [~tvalentyn] [~altay]
> CVE-2021-41496 vulnerability in numpy library
> ---------------------------------------------
>
> Key: BEAM-14025
> URL: https://issues.apache.org/jira/browse/BEAM-14025
> Project: Beam
> Issue Type: Bug
> Components: dependencies, sdk-py-core
> Affects Versions: 2.36.0
> Reporter: Mohinuddin
> Priority: P2
> Labels: security
>
> [https://cve.report/CVE-2021-41496]
> Potential buffer overflow in the array_from_pyobj function of fortranobject.c
> in NumPy < 1.19, which allows attackers to conduct a Denial of Service
> attacks by carefully constructing an array with negative values. NOTE: The
> vendor does not agree this is a vulnerability; the negative dimensions can
> only be created by an already privileged user (or internally).
> Fix: As a fix, the current numpy library version needs to be upgraded to
> 1.22.x
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
