CVE-2019-6446

Description

** DISPUTED ** An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior that might have legitimate applications in (for example) loading serialized Python object arrays from trusted and authenticated sources.

How to fix CVE-2019-6446

To remediate CVE-2019-6446, upgrade the affected package to a fixed version below.

• —no fix listed
• —upgrade to 1.16.1 or later

Is CVE-2019-6446 being exploited?

Likely — EPSS is 71.5%, placing CVE-2019-6446 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (2)

• from 0, <= 1.16.0
• from 0, < 1.16.1

CVSS scores

References (17)

• ADVISORYgithub.com/advisories/GHSA-9fq2-x9r6-wfmf
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2019-6446
• PATCHgithub.com/numpy/numpy
• WEBlists.opensuse.org/opensuse-security-announce/2019-09/msg00091.html
• WEB