SUSE-SU-2019:13977-1
- Source
- https://www.suse.com/support/update/announcement/2019/suse-su-201913977-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2019:13977-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2019:13977-1
- Related
- Published
- 2019-03-12T17:41:20Z
- Modified
- 2019-03-12T17:41:20Z
- Summary
- Security update for python-numpy
- Details
-
This update for python-numpy fixes the following issues:
Security issue fixed:
- CVE-2019-6446: Set allowpickle to false by default to restrict loading untrusted content (bsc#1122208). With this update we decrease the possibility of allowing remote attackers to execute arbitrary code by misusing numpy.load(). A warning during runtime will show-up when the allowpickle is not explicitly set.
NOTE: By applying this update the behavior of python-numpy changes, which might break your application. In order to get the old behaviour back, you have to explicitly set
allow_pickleto True. Be aware that this should only be done for trusted input, as loading untrusted input might lead to arbitrary code execution. - References