CVE-2021-34141

An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."

Red Hat products using an affected version of numpy are at essentially no risk of exploitation from this vulnerability given the high privileges and high complexity required for successful exploitation. The preconditions necessary to exploit are:

1. A privileged user or a non-standard configuration of numpy to provide a non-validated dtype string.
2. The ability to execute arbitrary code at runtime.

More specifically:

1. A user must be able to provide a non-validated dtype string to be parsed by numpy; something that would require a privileged user or a non-standard configuration.
2. Even then, the specific code block where the vulnerability is present cannot be reached without the attacker modifying the runtime environment to prevent an error from being thrown earlier in the code (before the string comparison), when the code checks an internal dictionary to determine the validity of the user-provided string type. Such runtime modifications would require executing arbitrary Python code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.