high7.5
CVE-2017-12852
Numpy missing input validation
Impact
The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | numpy | < 1.13.3 | 1.13.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Numpy | Numpy | through 1.13.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/BT123/testcasesForMyRequest/tree/master/CVE-2017-12852
- https://github.com/numpy/numpy/issues/9560#issuecomment-322395292
- https://github.com/advisories/GHSA-frgw-fgh6-9g52
- https://nvd.nist.gov/vuln/detail/CVE-2017-12852
- https://github.com/numpy/numpy/releases/tag/v1.13.3
- https://github.com/pypa/advisory-database/tree/main/vulns/numpy/PYSEC-2017-1.yaml