CVE-2019-6446: Input Validation
DISPUTED An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior that might have legitimate applications in (for example) loading serialized Python object arrays from trusted and authenticated sources.
Other sources
An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call.
Upstream issue: https://github.com/numpy/numpy/issues/12759
Upstream patch: https://github.com/numpy/numpy/commit/a2bd3a7eabfe053d6d16a2130fdcad9e5211f6bb
— Red Hat
An issue was discovered in NumPy before 1.16.3. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior that might have legitimate applications in (for example) loading serialized Python object arrays from trusted and authenticated sources.
— NVD
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this issue in NumPy?
The vulnerability ID for this issue in NumPy is CVE-2019-6446.
What is the severity rating of CVE-2019-6446?
The severity rating of CVE-2019-6446 is critical with a score of 9.8.
How does CVE-2019-6446 affect NumPy?
CVE-2019-6446 affects NumPy versions 1.16.0 and earlier.
How can attackers exploit CVE-2019-6446?
Attackers can exploit CVE-2019-6446 by executing arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call.
Are there any references available for CVE-2019-6446?
Yes, you can find references for CVE-2019-6446 at the following links: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-6446), [GitHub Issue](https://github.com/numpy/numpy/issues/12759), [Bugzilla SUSE](https://bugzilla.suse.com/show_bug.cgi?id=1122208).