—

PYSEC-2021-870

Quick fix

PYSEC-2021-870 — cvxopt: upgrade to the fixed version with the command below.

pip install --upgrade 'cvxopt>=1.2.7'

Details

Incomplete string comparison vulnerability exits in cvxopt.org cvxop <= 1.2.6 in APIs (cvxopt.cholmod.diag, cvxopt.cholmod.getfactor, cvxopt.cholmod.solve, cvxopt.cholmod.spsolve), which allows attackers to conduct Denial of Service attacks by construct fake Capsule objects.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/cvxopt

Introduced in: 0Fixed in: 1.2.7

Fixpip install --upgrade 'cvxopt>=1.2.7'

References

https://github.com/cvxopt/cvxopt/issues/193[REPORT]
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CXTPM3DGVYTYQ54OFCMXZVWVOMR7JM2D/[WEB]
https://github.com/advisories/GHSA-8rh6-h94m-vj54[ADVISORY]