NumPy Is Awaiting Fix for Critical Remote Code Execution Bug

guest · Jan 24, 2019

NumPy Is Awaiting Fix for Critical Remote Code Execution Bug
January 24, 2019
https://www.bleepingcomputer.com/ne...g-fix-for-critical-remote-code-execution-bug/

The current version of the popular NumPy library relies on unsafe default usage of a Python module that could lead to remote code execution in the context of the affected application.

The issue was raised on January 16 and affects NumPy versions 1.10 (released in 2015) through 1.16, which is the latest release at the moment, released on January 14. Efforts are underway to deliver a fix.
Default setting opens door to risk
The issue was reported by security researcher Sherwel Nan, who says that if a Python application loads malicious data via the 'numpy.load' function an attacker can obtain remote code execution on the machine.
Critical severity rating
The bug reported by Nan is now tracked as CVE-2019-6446 and is marked as critical, with a severity score of 9.8 out of 10, as per the Common Vulnerability Scoring System (CVSS) version 3.
Click to expand...

Log in or Sign up

NumPy Is Awaiting Fix for Critical Remote Code Execution Bug

guest Guest

Log in or Sign up

NumPy Is Awaiting Fix for Critical Remote Code Execution Bug

guest Guest

Useful Searches