RHSA-2019:3704: Moderate: numpy security update
The numpy packages provide NumPY. NumPY is an extension to the Python programming language, which adds support for large, multi-dimensional arrays and matrices, and a library of mathematical functions that operate on such arrays.Security Fix(es): numpy: crafted serialized object passed in numpy.load() in pickle python module allows arbitrary code execution (CVE-2019-6446) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/numpyto a version that resolves this vulnerability.Fixed in 1.14.3-9.el8 - Upgrade
Upgrade
redhat/numpy-debugsourceto a version that resolves this vulnerability.Fixed in 1.14.3-9.el8 - Upgrade
Upgrade
redhat/python3-numpyto a version that resolves this vulnerability.Fixed in 1.14.3-9.el8 - Upgrade
Upgrade
redhat/python3-numpy-debuginfoto a version that resolves this vulnerability.Fixed in 1.14.3-9.el8 - Upgrade
Upgrade
redhat/python3-numpy-f2pyto a version that resolves this vulnerability.Fixed in 1.14.3-9.el8 - Upgrade
Upgrade
redhat/numpy-debugsourceto a version that resolves this vulnerability.Fixed in 1.14.3-9.el8.aa - Upgrade
Upgrade
redhat/python3-numpyto a version that resolves this vulnerability.Fixed in 1.14.3-9.el8.aa - Upgrade
Upgrade
redhat/python3-numpy-debuginfoto a version that resolves this vulnerability.Fixed in 1.14.3-9.el8.aa - Upgrade
Upgrade
redhat/python3-numpy-f2pyto a version that resolves this vulnerability.Fixed in 1.14.3-9.el8.aa - Upgrade
Upgrade
numpyto a version that resolves this vulnerability.Patch CVE-2019-6446
Event History
Frequently Asked Questions
What is the severity of RHSA-2019:3704?
The severity of RHSA-2019:3704 is classified as important.
How do I fix RHSA-2019:3704?
To fix RHSA-2019:3704, update the affected numpy packages to version 1.14.3-9.el8 or higher.
Which packages are affected by RHSA-2019:3704?
The affected packages include numpy, python3-numpy, and their debug sources.
What vulnerabilities are addressed in RHSA-2019:3704?
RHSA-2019:3704 addresses vulnerabilities related to crafted serialized data processing in numpy.
Is it important to apply the fix for RHSA-2019:3704?
Yes, applying the fix for RHSA-2019:3704 is important to maintain system security and integrity.