CVE-2021-33430

{"id": "CVE-2021-33430", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "published": "2021-12-17T19:15:07.500", "references": [{"url": "https://github.com/numpy/numpy/issues/18939", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/numpy/numpy/issues/18939", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-120"}]}], "descriptions": [{"lang": "en", "value": "A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service. NOTE: The vendor does not agree this is a vulneraility; In (very limited) circumstances a user may be able provoke the buffer overflow, the user is most likely already privileged to at least provoke denial of service by exhausting memory. Triggering this further requires the use of uncommon API (complicated structured dtypes), which is very unlikely to be available to an unprivileged user"}, {"lang": "es", "value": "** EN DISPUTA ** Se presenta una vulnerabilidad de desbordamiento del b\u00fafer en NumPy versi\u00f3n 1.9.x en la funci\u00f3n PyArray_NewFromDescr_int del archivo ctors.c cuando son especificados arrays de grandes dimensiones (m\u00e1s de 32) desde el c\u00f3digo de Python, lo que podr\u00eda permitir a un usuario malicioso causar una Denegaci\u00f3n de Servicio. NOTA: El proveedor no est\u00e1 de acuerdo en que esto sea una vulnerabilidad; en circunstancias (muy limitadas) un usuario puede ser capaz de provocar el desbordamiento del b\u00fafer, lo m\u00e1s probable es que el usuario ya tenga privilegios para al menos provocar la denegaci\u00f3n de servicio agotando la memoria. Desencadenar esto requiere adem\u00e1s el uso de una API poco com\u00fan (dtypes estructurados complicados), que es muy poco probable que est\u00e9 disponible para un usuario sin privilegios"}], "lastModified": "2024-11-21T06:08:48.743", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:numpy:numpy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "850F12C4-29D8-4406-B851-8EA669B3F80E", "versionEndIncluding": "1.9.3", "versionStartIncluding": "1.9.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}