Numpy==1.21.3 Denial of Service (DoS) & NULL Pointer Dereference & Buffer Overflow

Open

#202 opened on Aug 17, 2023 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 3/5
Estimated time: 1-2 days
Newbie friendliness: 25/100

Issue type: Bug
Clarity: Needs clarification
Activity status: Stale
Tech stack: numpy, python
Domain: security

Research direction

Start by checking the package dependency metadata and confirming whether requirements.txt is intentionally absent, then compare the declared NumPy constraint with the three linked Snyk advisories. Done means determining whether databricks-sql-python brings in numpy==1.21.3 and documenting or making the dependency change needed to resolve the reported vulnerabilities.

Written by the indexing model from the issue text.

Description

Synk security scan is giving Denial of Service (DoS) & NULL Pointer Dereference & Buffer Overflow to numpy==1.21.3 version.

I couldn't locate requirements.txt file for databricks-sql-python package. Is the version >=1.21.3?

This package is identified as one that depends on this specific Numpy version.

https://security.snyk.io/vuln/SNYK-PYTHON-NUMPY-2321964?_gl=1%2a1f3l87s%2a_ga%2aODg3MDQzNTMyLjE2OTA0MjUyOTE.%2a_ga_X9SH3KP7B4%2aMTY5MjI4OTA0MC42LjEuMTY5MjI5MjY3MC4wLjAuMA..

https://security.snyk.io/vuln/SNYK-PYTHON-NUMPY-2321966?_gl=1%2a1m55uiu%2a_ga%2aODg3MDQzNTMyLjE2OTA0MjUyOTE.%2a_ga_X9SH3KP7B4%2aMTY5MjI4OTA0MC42LjEuMTY5MjI5MjY4Mi4wLjAuMA..

https://security.snyk.io/vuln/SNYK-PYTHON-NUMPY-2321970?_gl=1%2a1rlzldx%2a_ga%2aODg3MDQzNTMyLjE2OTA0MjUyOTE.%2a_ga_X9SH3KP7B4%2aMTY5MjI4OTA0MC42LjEuMTY5MjI5MjU3NC4wLjAuMA..

Dominant language: Python
Stars: 233
Forks: 152
Avg merge: 21h 5m
Merged PRs (30d): 10

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

[essnmx] Fix typo in NXLauetof application definition Open

essnmx good first issue

Difficulty 1/5 Under an hour Newbie friendliness 95/100

scipp/ess#760 · Opened Sep 23, 2026
[Feature] 奇物选择添加优先级 Open

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

syfoud/Simulated_Scepter#174 · Opened Sep 23, 2026
garak adapter grades a NaN detector score as PASS Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

Giskard-AI/giskard-oss#2840 · 1 comment · Opened Sep 23, 2026
A claim comment carrying the issue number is silently declined while the workflow reports success Open

area: repo bug perceived difficulty: 2

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

Nitjsefnie-Harness-Commons/daedalus#926 · Opened Sep 23, 2026
`IOCExtractor` always fails: `ioc_analyzer.build()` takes 1 argument but the agent dispatcher passes 2 Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

yeti-platform/yeti#1380 · Opened Sep 23, 2026

More Python issues