—

PYSEC-2021-855

Quick fix

PYSEC-2021-855 — numpy: upgrade to the fixed version with the command below.

pip install --upgrade 'numpy>=1.10.0'

Details

Incomplete string comparison in the numpy.core component in NumPy1.9.x, which allows attackers to fail the APIs via constructing specific string objects.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/numpy

Introduced in: 1.9.0Fixed in: 1.10.0

Fixpip install --upgrade 'numpy>=1.10.0'

References

https://github.com/numpy/numpy/issues/18993[REPORT]
https://github.com/advisories/GHSA-fpfv-jqm9-f5jm[ADVISORY]