CVE-2021-34141CWE-697

CVE-2021-34141

Medium · published December 18, 2021

CVSS v3.1
5.3
EPSS
2%
Percentile
76.7
In the wild
Unconfirmed
What it is

An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.01679 · 76.7th percentile
Weakness
CWE-697 · Incorrect Comparison
Published
2021-12-18T00:15Z
Affected products (2)
ProductVersionsFixed in
numpy/numpy< 1.22.01.22.0
oracle/communications_cloud_native_core_policyall versions—
References (4)
https://github.com/numpy/numpy/issues/18993 · [email protected]https://www.oracle.com/security-alerts/cpujul2022.html · [email protected]https://github.com/numpy/numpy/issues/18993 · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujul2022.html · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 17 DEC 18:43Z
    An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing…
    cvelistv5