kritik
CVE-2019-6446
numpy: crafted serialized object passed in numpy.load() in pickle python module allows arbitrary code execution
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat8.8CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA. Daha düşük diyenler: Red Hat (orta), AlmaLinux (orta), Oracle (orta), Rocky Linux (orta).
Açıklama
An issue was discovered in NumPy before 1.16.3. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior that might have legitimate applications in (for example) loading serialized Python object arrays from trusted and authenticated sources.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| pip::GitHub Security Advisory pip | numpy | 1.16.3 |
| alma 8 | python27:2.7::python-psycopg2-doc, python27:2.7::python2-Cython, python27:2.7::python2-PyMySQL ve 24 tane daha | 2.7.5-7.module_el8.6.0+2781+fed64c13 ve 22 tane daha |
| debian 8 | python-numpy | düzeltme belirtilmemiş |
| Oracle Linux 8 | babel, python-nose-docs, python-psycopg2-doc ve 61 tane daha | 2.5.1-9.module+el8.1.0+5396+a4103ad2 ve 42 tane daha |
| Red Hat | numpy, numpy-f2py, python2-numpy ve 8 tane daha | düzeltme belirtilmemiş |
| rocky 8 | python27:2.7::babel, python27:2.7::python-psycopg2-doc, python27:2.7::python2-Cython ve 30 tane daha | 2.5.1-9.module+el8.4.0+403+9ae17a31 ve 26 tane daha |
6 kaynaktaki 137 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| pip::GitHub Security Advisory pip | numpy | 1.16.3 |
| alma 8 | python27:2.7::python-psycopg2-doc | 2.7.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-Cython | 0.28.1-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-PyMySQL | 0.8.0-10.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-attrs | 17.4.0-10.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-chardet | 3.0.4-10.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-coverage | 4.5.1-4.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-dns | 1.15.0-10.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-docs | 2.7.16-2.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-docs-info | 2.7.16-2.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-docutils | 0.14-12.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-funcsigs | 1.0.2-13.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-idna | 2.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-ipaddress | 1.0.18-6.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-markupsafe | 0.23-19.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-mock | 2.0.0-13.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pluggy | 0.6.0-8.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-psycopg2 | 2.7.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-psycopg2-debug | 2.7.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-psycopg2-tests | 2.7.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-py | 1.5.3-6.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pysocks | 1.6.8-6.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pytest | 3.4.2-13.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pytest-mock | 1.9.0-4.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pytz | 2017.2-12.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pyyaml | 3.12-16.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-rpm-macros | 3-38.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-setuptools_scm | 1.15.7-6.module_el8.6.0+2781+fed64c13 |
| debian 8 | python-numpy | düzeltme belirtilmemiş |
| Oracle Linux 8 | babel | 2.5.1-9.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python-nose-docs | 1.3.7-30.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python-psycopg2-doc | 2.7.5-7.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python-sqlalchemy-doc | 1.3.2-1.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2 | 2.7.16-12.0.1.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-Cython | 0.28.1-7.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-PyMySQL | 0.8.0-10.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-attrs | 17.4.0-10.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-babel | 2.5.1-9.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-backports | 1.0-15.0.1.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-backports-ssl_match_hostname | 3.5.0.1-11.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-bson | 3.6.1-11.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-chardet | 3.0.4-10.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-coverage | 4.5.1-4.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-debug | 2.7.16-12.0.1.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-devel | 2.7.16-12.0.1.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-dns | 1.15.0-10.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-docs | 2.7.16-2.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-docs-info | 2.7.16-2.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-docutils | 0.14-12.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-funcsigs | 1.0.2-13.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-idna | 2.5-7.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-ipaddress | 1.0.18-6.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-jinja2 | 2.10-8.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-libs | 2.7.16-12.0.1.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-lxml | 4.2.3-3.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-markupsafe | 0.23-19.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-mock | 2.0.0-13.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-nose | 1.3.7-30.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-numpy | 1:1.14.2-13.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-numpy-doc | 1:1.14.2-13.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-numpy-f2py | 1:1.14.2-13.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-pip | 9.0.3-14.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-pip-wheel | 9.0.3-14.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-pluggy | 0.6.0-8.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-psycopg2 | 2.7.5-7.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-psycopg2-debug | 2.7.5-7.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-psycopg2-tests | 2.7.5-7.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-py | 1.5.3-6.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-pygments | 2.2.0-20.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-pymongo | 3.6.1-11.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-pymongo-gridfs | 3.6.1-11.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-pysocks | 1.6.8-6.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-pytest | 3.4.2-13.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-pytest-mock | 1.9.0-4.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-pytz | 2017.2-12.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-pyyaml | 3.12-16.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-requests | 2.20.0-2.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-rpm-macros | 3-38.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-scipy | 1.0.0-20.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-setuptools | 39.0.1-11.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-setuptools-wheel | 39.0.1-11.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-setuptools_scm | 1.15.7-6.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-six | 1.11.0-5.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-sqlalchemy | 1.3.2-1.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-test | 2.7.16-12.0.1.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-tkinter | 2.7.16-12.0.1.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-tools | 2.7.16-12.0.1.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-urllib3 | 1.24.2-1.0.2.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-virtualenv | 15.1.0-19.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-wheel | 1:0.31.1-2.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python2-wheel-wheel | 1:0.31.1-2.module+el8.1.0+5396+a4103ad2 |
| Oracle Linux 8 | python3-numpy | 1:1.14.3-9.el8 |
| Oracle Linux 8 | python3-numpy-f2py | 1:1.14.3-9.el8 |
| Red Hat | numpy | düzeltme belirtilmemiş |
| Red Hat | numpy-f2py | düzeltme belirtilmemiş |
| Red Hat | python2-numpy | düzeltme belirtilmemiş |
| Red Hat | python2-numpy-f2py | düzeltme belirtilmemiş |
| Red Hat | python27-numpy | düzeltme belirtilmemiş |
| Red Hat | python27-numpy-f2py | düzeltme belirtilmemiş |
| Red Hat | rh-python35-numpy | düzeltme belirtilmemiş |
| Red Hat | rh-python35-numpy-f2py | düzeltme belirtilmemiş |
| Red Hat | rh-python36-numpy | düzeltme belirtilmemiş |
| Red Hat | rh-python36-numpy-f2py | düzeltme belirtilmemiş |
| Red Hat | rhvm-appliance | düzeltme belirtilmemiş |
| rocky 8 | python27:2.7::babel | 2.5.1-9.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python-psycopg2-doc | 2.7.5-7.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-Cython | 0.28.1-7.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-PyMySQL | 0.8.0-10.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-attrs | 17.4.0-10.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-babel | 2.5.1-9.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-chardet | 3.0.4-10.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-coverage | 4.5.1-4.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-dns | 1.15.0-10.module+el8.7.0+1062+663ba31c |
| rocky 8 | python27:2.7::python2-docs | 2.7.16-2.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-docs-info | 2.7.16-2.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-docutils | 0.14-12.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-funcsigs | 1.0.2-13.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-idna | 2.5-7.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-ipaddress | 1.0.18-6.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-jinja2 | 2.10-8.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-markupsafe | 0.23-19.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-mock | 2.0.0-13.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-pluggy | 0.6.0-8.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-psycopg2 | 2.7.5-7.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-psycopg2-debug | 2.7.5-7.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-psycopg2-tests | 2.7.5-7.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-py | 1.5.3-6.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-pysocks | 1.6.8-6.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-pytest | 3.4.2-13.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-pytest-mock | 1.9.0-4.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-pytz | 2017.2-12.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-pyyaml | 3.12-16.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-rpm-macros | 3-38.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-setuptools_scm | 1.15.7-6.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python3-numpy | 1:1.14.3-9.el8 |
| rocky 8 | python3-numpy-f2py | 1:1.14.3-9.el8 |
| rocky 8 | python36:3.6::python-nose-docs | 1.3.7-30.module+el8.3.0+120+426d8baf |
Referanslar
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00091.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00092.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00015.html
- http://www.securityfocus.com/bid/106670
- https://access.redhat.com/errata/RHSA-2019:3335
- https://access.redhat.com/errata/RHSA-2019:3704
- https://access.redhat.com/security/cve/CVE-2019-6446
- https://bugzilla.redhat.com/1667950
52 referansın hepsi
- https://bugzilla.redhat.com/1680967
- https://bugzilla.redhat.com/1688169
- https://bugzilla.redhat.com/1695570
- https://bugzilla.redhat.com/1695572
- https://bugzilla.redhat.com/1700824
- https://bugzilla.redhat.com/1700993
- https://bugzilla.redhat.com/1702473
- https://bugzilla.redhat.com/1709599
- https://bugzilla.redhat.com/1718398
- https://bugzilla.redhat.com/1734126
- https://bugzilla.redhat.com/show_bug.cgi?id=1667950
- https://bugzilla.redhat.com/show_bug.cgi?id=1680967
- https://bugzilla.redhat.com/show_bug.cgi?id=1688169
- https://bugzilla.redhat.com/show_bug.cgi?id=1695570
- https://bugzilla.redhat.com/show_bug.cgi?id=1695572
- https://bugzilla.redhat.com/show_bug.cgi?id=1700824
- https://bugzilla.redhat.com/show_bug.cgi?id=1700993
- https://bugzilla.redhat.com/show_bug.cgi?id=1702473
- https://bugzilla.redhat.com/show_bug.cgi?id=1709599
- https://bugzilla.redhat.com/show_bug.cgi?id=1718398
- https://bugzilla.redhat.com/show_bug.cgi?id=1734126
- https://bugzilla.suse.com/show_bug.cgi?id=1122208
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11236
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11324
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6446
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9740
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9947
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9948
- https://errata.almalinux.org/8/ALSA-2019-3335.html
- https://errata.rockylinux.org/RLSA-2019:3335
- https://github.com/advisories/GHSA-9fq2-x9r6-wfmf
- https://github.com/numpy/numpy
- https://github.com/numpy/numpy/commit/89b688732b37616c9d26623f81aaee1703c30ffb
- https://github.com/numpy/numpy/issues/12759
- https://github.com/numpy/numpy/pull/12889
- https://github.com/numpy/numpy/pull/13359
- https://github.com/pypa/advisory-database/tree/main/vulns/numpy/PYSEC-2019-108.yaml
- https://linux.oracle.com/cve/CVE-2019-6446.html
- https://linux.oracle.com/errata/ELSA-2019-3704.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ZZAYIQNUUYXGMKHSPEEXS4TRYFOUYE4
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ZZAYIQNUUYXGMKHSPEEXS4TRYFOUYE4/
- https://nvd.nist.gov/vuln/detail/CVE-2019-6446
- https://web.archive.org/web/20210124234613/https://www.securityfocus.com/bid/106670
- https://www.cve.org/CVERecord?id=CVE-2019-6446