CVE-2021-34141 Incorrect Comparison in NumPy
An incomplete string comparison in NumPy allows attackers to trigger slightly incorrect copying, though the vendor deems the behavior harmless.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-34141?
CVE-2021-34141 is a medium-severity vulnerability in Oracle Communications Cloud Native Core Policy, published on 17 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."
Weakness: CWE-697
Which versions are affected by CVE-2021-34141?
3 open source packages ship an affected version, including numpy. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
numpy PyPI | All versions | 1.22 |
numpy PyPI | All versions | 1.22 |
numpy PyPI | From 1.9.0 | 1.10.0 |
Products include Numpy Numpy, Oracle Communications Cloud Native Core Policy.
How do I fix CVE-2021-34141?
Upgrade numpy to a fixed version for your release line: 1.22 or 1.10.0.
Is CVE-2021-34141 being exploited?
There is no known exploitation of CVE-2021-34141 in the wild and no public exploit code.
Other vulnerabilities in Oracle Communications Cloud Native Core Policy
- CVE-2017-12852 Numpy missing input validation
- CVE-2021-41496 Buffer Copy without Checking Size of Input in NumPy
- CVE-2014-1858 Arbitrary file write in NumPy
- CVE-2021-33430 NumPy Buffer Overflow (Disputed)
- CVE-2021-41495 NumPy NULL Pointer Dereference
All Oracle Communications Cloud Native Core Policy vulnerabilities
Sources
Also known as CLSA-2025-1760400833, CLSA-2026-1781139192, DEBIAN-CVE-2021-34141, ECHO-4195-024c-0bcd, GHSA-fpfv-jqm9-f5jm, MINI-wq6v-xg86-wg83 and 2 more.