CVE-2021-34141

Отчет

Red Hat products using an affected version of numpy are at essentially no risk of exploitation from this vulnerability given the high privileges and high complexity required for successful exploitation. The preconditions necessary to exploit are:

1. A privileged user or a non-standard configuration of numpy to provide a non-validated dtype string.
2. The ability to execute arbitrary code at runtime. More specifically:
3. A user must be able to provide a non-validated dtype string to be parsed by numpy; something that would require a privileged user or a non-standard configuration.
4. Even then, the specific code block where the vulnerability is present cannot be reached without the attacker modifying the runtime environment to prevent an error from being thrown earlier in the code (before the string comparison), when the code checks an internal dictionary to determine the validity of the user-provided string type. Such runtime modifications would require executing arbitrary Python code.