CVE-2019-6446 Numpy Deserialization of Untrusted Data
Remote attackers can execute arbitrary code via crafted serialized objects in NumPy, requiring users to upgrade to a patched version.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-6446?
CVE-2019-6446 is a critical unsafe deserialization vulnerability in Fedoraproject Fedora, published on 16 Jan 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in NumPy before 1.16.3. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior that might have legitimate applications in (for example) loading serialized Python object arrays from trusted and authenticated sources.
Weakness: CWE-502
Which versions are affected by CVE-2019-6446?
3 open source packages ship an affected version, including numpy. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
numpy PyPI | All versions | 1.16.1 |
numpy PyPI | All versions | 1.16.3 |
numpy PyPI | All versions | 1.16.3 |
Linux distribution packages (32)
numpy Red Hat:enterprise_linux:8::appstream | All versions | 1:1.14.3-9.el8 |
numpy-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 1:1.14.3-9.el8 |
python3-numpy Red Hat:enterprise_linux:8::appstream | All versions | 1:1.14.3-9.el8 |
python3-numpy-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:1.14.3-9.el8 |
python3-numpy-f2py Red Hat:enterprise_linux:8::appstream | All versions | 1:1.14.3-9.el8 |
numpy Rocky Linux:8 | All versions | 1:1.14.3-9.el8 |
python-numpy SUSE:Linux Enterprise Desktop 12 SP3 | All versions | 1.8.0-5.8.1 |
python-numpy SUSE:Linux Enterprise Desktop 12 SP4 | All versions | 1.8.0-5.8.1 |
python-numpy SUSE:Linux Enterprise Module for Basesystem 15 | All versions | 1.14.0-4.5.1 |
python-numpy SUSE:Linux Enterprise Module for Basesystem 15 | All versions | 1.16.1-4.8.1 |
python-numpy SUSE:Linux Enterprise Module for Basesystem 15 SP1 | All versions | 1.16.1-4.8.1 |
python-numpy_1_13_3-gnu-hpc SUSE:Linux Enterprise Module for HPC 12 | All versions | 1.13.3-4.9.1 |
python-numpy_1_14_0-gnu-hpc SUSE:Linux Enterprise Module for HPC 15 | All versions | 1.14.0-4.5.1 |
python-numpy_1_16_1-gnu-hpc SUSE:Linux Enterprise Module for HPC 15 | All versions | 1.16.1-4.8.1 |
python-numpy_1_16_1-gnu-hpc SUSE:Linux Enterprise Module for HPC 15 SP1 | All versions | 1.16.1-4.8.1 |
python-numpy SUSE:Linux Enterprise Module for Python 2 15 SP1 | All versions | 1.16.1-4.8.1 |
python-numpy SUSE:Linux Enterprise Point of Sale 11 SP3 | All versions | 1.3.0-1.3.3.1 |
python-numpy SUSE:Linux Enterprise Server 11 SP4 | All versions | 1.8.0-6.4.1 |
python-numpy SUSE:Linux Enterprise Server 12 SP3 | All versions | 1.8.0-5.8.1 |
python-numpy SUSE:Linux Enterprise Server 12 SP4 | All versions | 1.8.0-5.8.1 |
python-numpy SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | All versions | 1.8.0-6.4.1 |
python-numpy SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 1.8.0-5.8.1 |
python-numpy SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 1.8.0-5.8.1 |
python-numpy SUSE:Linux Enterprise Software Development Kit 11 SP4 | All versions | 1.8.0-6.4.1 |
python-numpy SUSE:Linux Enterprise Software Development Kit 12 SP3 | All versions | 1.8.0-5.8.1 |
python-numpy SUSE:Linux Enterprise Software Development Kit 12 SP4 | All versions | 1.8.0-5.8.1 |
python-numpy SUSE:Package Hub 15 SP1 | All versions | 1.16.1-bp151.2.3.1 |
python-numpy_1_16_1-gnu-hpc SUSE:Package Hub 15 SP1 | All versions | 1.16.1-bp151.2.3.1 |
python-numpy openSUSE:Leap 15.0 | All versions | 1.16.1-lp150.8.1 |
python-numpy_1_16_1-gnu-hpc openSUSE:Leap 15.0 | All versions | 1.16.1-lp150.8.1 |
python-numpy openSUSE:Leap 15.1 | All versions | 1.16.1-lp151.5.3.1 |
python-numpy_1_16_1-gnu-hpc openSUSE:Leap 15.1 | All versions | 1.16.1-lp151.5.3.1 |
Products include Fedoraproject Fedora, Numpy Numpy.
How do I fix CVE-2019-6446?
Upgrade numpy to a fixed version for your release line: 1.16.1 or 1.16.3.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2019-6446 being exploited?
There is no known exploitation of CVE-2019-6446 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as CLSA-2025-1754266434, CLSA-2025-1755216832, GHSA-9fq2-x9r6-wfmf, MGASA-2019-0322, PYSEC-2019-108, RHSA-2019:3704 and 12 more.