An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to     trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that     this reported code behavior is completely harmless. (CVE-2021-34141)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of NumPy installed on the remote host is prior to 1.22.0. It is, therefore, affected by an incomplete string comparison vulnerability in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is completely harmless.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5763-1 advisory.

    It was discovered that NumPy did not properly manage memory when specifying arrays of large dimensions. If     a user were tricked into running malicious Python file, an attacker could cause a denial of service. This     issue only affected Ubuntu 20.04 LTS. (CVE-2021-33430)

    It was discovered that NumPy did not properly perform string comparison operations under certain     circumstances. An attacker could possibly use this issue to cause NumPy to crash, resulting in a denial of     service. (CVE-2021-34141)

    It was discovered that NumPy did not properly manage memory under certain circumstances. An attacker could     possibly use this issue to cause NumPy to crash, resulting in a denial of service. (CVE-2021-41495,     CVE-2021-41496)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
223792	Linux Distros Unpatched Vulnerability : CVE-2021-34141	Nessus	Misc.	medium
210055	NumPy < 1.22.0 Vulnerability - CVE-2021-34141	Nessus	Artificial Intelligence	medium
168470	Ubuntu 20.04 LTS / 22.04 LTS : NumPy vulnerabilities (USN-5763-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2021-34141

medium

Tenable Plugins

medium

medium

medium