An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior that might have legitimate applications in (for example) loading serialized Python object arrays from trusted and authenticated sources

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2019:3704 advisory.

  - ** DISPUTED ** An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module     unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as     demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior that     might have legitimate applications in (for example) loading serialized Python object arrays from trusted     and authenticated sources. (CVE-2019-6446)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2019:3335 advisory.

  - In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the     request parameter. (CVE-2019-11236)

  - The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA     certificates is different from the OS store of CA certificates, which results in SSL connections     succeeding in situations where a verification failure is the correct outcome. This is related to use of     the ssl_context, ca_certs, or ca_certs_dir argument. (CVE-2019-11324)

  - ** DISPUTED ** An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module     unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as     demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior that     might have legitimate applications in (for example) loading serialized Python object arrays from trusted     and authenticated sources. (CVE-2019-6446)

  - An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.
    CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument     to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an     HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10,     v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12,     v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1,     v3.7.8, v3.7.8rc1, v3.7.9. (CVE-2019-9740)

  - An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.
    CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument     to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character)     followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue.
    This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1,     v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4,     v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.
    (CVE-2019-9947)

  - urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote     attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a     urllib.urlopen('local_file:///etc/passwd') call. (CVE-2019-9948)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-3335 advisory.

  - An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.
    CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument     to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an     HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10,     v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12,     v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1,     v3.7.8, v3.7.8rc1, v3.7.9. (CVE-2019-9740)

  - An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.
    CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument     to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character)     followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue.
    This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1,     v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4,     v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.
    (CVE-2019-9947)

  - urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote     attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a     urllib.urlopen('local_file:///etc/passwd') call. (CVE-2019-9948)

  - In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the     request parameter. (CVE-2019-11236)

  - ** DISPUTED ** An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module     unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as     demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior that     might have legitimate applications in (for example) loading serialized Python object arrays from trusted     and authenticated sources. (CVE-2019-6446)

  - The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA     certificates is different from the OS store of CA certificates, which results in SSL connections     succeeding in situations where a verification failure is the correct outcome. This is related to use of     the ssl_context, ca_certs, or ca_certs_dir argument. (CVE-2019-11324)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-3704 advisory.

  - ** DISPUTED ** An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module     unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as     demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior that     might have legitimate applications in (for example) loading serialized Python object arrays from trusted     and authenticated sources. (CVE-2019-6446)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3704 advisory.

  - numpy: crafted serialized object passed in numpy.load() in pickle python module allows arbitrary code     execution (CVE-2019-6446)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3335 advisory.

  - python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on     internal service (CVE-2019-11236)

  - python-urllib3: Certification mishandle when error should be thrown (CVE-2019-11324)

  - numpy: crafted serialized object passed in numpy.load() in pickle python module allows arbitrary code     execution (CVE-2019-6446)

  - python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740)

  - python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947)

  - python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms     (CVE-2019-9948)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the numpy packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An issue was discovered in NumPy 1.16.0 and earlier. It     uses the pickle Python module unsafely, which allows     remote attackers to execute arbitrary code via a     crafted serialized object, as demonstrated by a     numpy.load call.(CVE-2019-6446)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the numpy packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An issue was discovered in NumPy 1.16.0 and earlier. It     uses the pickle Python module unsafely, which allows     remote attackers to execute arbitrary code via a     crafted serialized object, as demonstrated by a     numpy.load call. NOTE: third parties dispute this issue     because it is a behavior that might have legitimate     applications in (for example) loading serialized Python     object arrays from trusted and authenticated     sources.(CVE-2019-6446)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the numpy packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - ** DISPUTED ** An issue was discovered in NumPy 1.16.0     and earlier. It uses the pickle Python module unsafely,     which allows remote attackers to execute arbitrary code     via a crafted serialized object, as demonstrated by a     numpy.load call. NOTE: third parties dispute this issue     because it is a behavior that might have legitimate     applications in (for example) loading serialized Python     object arrays from trusted and authenticated     sources.(CVE-2019-6446)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the numpy packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - ** DISPUTED ** An issue was discovered in NumPy 1.16.0     and earlier. It uses the pickle Python module unsafely,     which allows remote attackers to execute arbitrary code     via a crafted serialized object, as demonstrated by a     numpy.load call. NOTE: third parties dispute this issue     because it is a behavior that might have legitimate     applications in (for example) loading serialized Python     object arrays from trusted and authenticated     sources.(CVE-2019-6446)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for numpy is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The numpy packages provide NumPY. NumPY is an extension to the Python programming language, which adds support for large, multi-dimensional arrays and matrices, and a library of mathematical functions that operate on such arrays.

Security Fix(es) :

* numpy: crafted serialized object passed in numpy.load() in pickle python module allows arbitrary code execution (CVE-2019-6446)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section.

An update for the python27:2.7 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing.

Security Fix(es) :

* numpy: crafted serialized object passed in numpy.load() in pickle python module allows arbitrary code execution (CVE-2019-6446)

* python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740)

* python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947)

* python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms (CVE-2019-9948)

* python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service (CVE-2019-11236)

* python-urllib3: Certification mishandle when error should be thrown (CVE-2019-11324)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section.

This update for python-numpy fixes the following issues :

Non-security issues fixed :

Updated to upstream version 1.16.1. (bsc#1149203) (jsc#SLE-8532)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python-numpy fixes the following issues :

Non-security issues fixed :

  - Updated to upstream version 1.16.1. (bsc#1149203)     (jsc#SLE-8532)

This update was imported from the SUSE:SLE-15:Update update project.

1.16.3, fix for CVE-2019-6446

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python-numpy fixes the following issue :

Security issue fixed :

  - CVE-2019-6446: Set allow_pickle to false by default to     restrict loading untrusted content (bsc#1122208). With     this update we decrease the possibility of allowing     remote attackers to execute arbitrary code by misusing     numpy.load(). A warning during runtime will show-up when     the allow_pickle is not explicitly set. NOTE: By     applying this update the behavior of python-numpy     changes, which might break your application. In order to     get the old behaviour back, you have to explicitly set     `allow_pickle` to True. Be aware that this should only     be done for trusted input, as loading untrusted input     might lead to arbitrary code execution.

This update was imported from the SUSE:SLE-15:Update update project.

This update for python-numpy fixes the following issues :

Security issue fixed :

CVE-2019-6446: Set allow_pickle to false by default to restrict loading untrusted content (bsc#1122208). With this update we decrease the possibility of allowing remote attackers to execute arbitrary code by misusing numpy.load(). A warning during runtime will show-up when the allow_pickle is not explicitly set.

NOTE: By applying this update the behavior of python-numpy changes, which might break your application. In order to get the old behaviour back, you have to explicitly set `allow_pickle` to True. Be aware that this should only be done for trusted input, as loading untrusted input might lead to arbitrary code execution.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python-numpy fixes the following issue :

Security issue fixed :

CVE-2019-6446: Set allow_pickle to false by default to restrict loading untrusted content (bsc#1122208). With this update we decrease the possibility of allowing remote attackers to execute arbitrary code by misusing numpy.load(). A warning during runtime will show-up when the allow_pickle is not explicitly set.

NOTE: By applying this update the behavior of python-numpy changes, which might break your application. In order to get the old behaviour back, you have to explicitly set `allow_pickle` to True. Be aware that this should only be done for trusted input, as loading untrusted input might lead to arbitrary code execution.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
185056	Rocky Linux 8 : numpy (RLSA-2019:3704)	Nessus	Rocky Linux Local Security Checks	critical
184906	Rocky Linux 8 : python27:2.7 (RLSA-2019:3335)	Nessus	Rocky Linux Local Security Checks	critical
180874	Oracle Linux 8 : python27:2.7 (ELSA-2019-3335)	Nessus	Oracle Linux Local Security Checks	critical
180751	Oracle Linux 8 : numpy (ELSA-2019-3704)	Nessus	Oracle Linux Local Security Checks	critical
145639	CentOS 8 : numpy (CESA-2019:3704)	Nessus	CentOS Local Security Checks	critical
145618	CentOS 8 : python27:2.7 (CESA-2019:3335)	Nessus	CentOS Local Security Checks	critical
142238	EulerOS 2.0 SP2 : numpy (EulerOS-SA-2020-2375)	Nessus	Huawei Local Security Checks	critical
140850	EulerOS 2.0 SP3 : numpy (EulerOS-SA-2020-2083)	Nessus	Huawei Local Security Checks	critical
137949	EulerOS Virtualization 3.0.6.0 : numpy (EulerOS-SA-2020-1730)	Nessus	Huawei Local Security Checks	critical
136248	EulerOS Virtualization for ARM 64 3.0.2.0 : numpy (EulerOS-SA-2020-1545)	Nessus	Huawei Local Security Checks	critical
134806	EulerOS 2.0 SP5 : numpy (EulerOS-SA-2020-1315)	Nessus	Huawei Local Security Checks	critical
130571	RHEL 8 : numpy (RHSA-2019:3704)	Nessus	Red Hat Local Security Checks	critical
130527	RHEL 8 : python27:2.7 (RHSA-2019:3335)	Nessus	Red Hat Local Security Checks	critical
130088	SUSE SLED15 / SLES15 Security Update : python-numpy (SUSE-SU-2019:2462-2)	Nessus	SuSE Local Security Checks	critical
129487	openSUSE Security Update : python-numpy (openSUSE-2019-2227)	Nessus	SuSE Local Security Checks	critical
129485	openSUSE Security Update : python-numpy (openSUSE-2019-2225)	Nessus	SuSE Local Security Checks	critical
129382	SUSE SLED15 / SLES15 Security Update : python-numpy (SUSE-SU-2019:2462-1)	Nessus	SuSE Local Security Checks	critical
124478	Fedora 30 : 1:numpy (2019-1dfe95a864)	Nessus	Fedora Local Security Checks	critical
122445	openSUSE Security Update : python-numpy (openSUSE-2019-245)	Nessus	SuSE Local Security Checks	critical
122345	SUSE SLES12 Security Update : python-numpy (SUSE-SU-2019:0448-1)	Nessus	SuSE Local Security Checks	critical
122308	SUSE SLED12 / SLES12 Security Update : python-numpy (SUSE-SU-2019:0419-1)	Nessus	SuSE Local Security Checks	critical
122307	SUSE SLED15 / SLES15 Security Update : python-numpy (SUSE-SU-2019:0418-1)	Nessus	SuSE Local Security Checks	critical
122150	SUSE SLES11 Security Update : python-numpy (SUSE-SU-2019:13951-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2019-6446

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical