SUSE has issued an advisory on January 18: https://lists.suse.com/pipermail/sle-security-updates/2022-January/010024.html It looks like CVE-2021-33430 was fixed in 1.21.0 and CVE-2021-41496 was fixed in 1.22.0 upstream. Mageia 8 is also affected.
Status comment: (none) => Patches available from upstreamWhiteboard: (none) => MGA8TOO
fixed in mga8/9 src: - python-numpy-1.19.4-1.1.mga8
Version: Cauldron => 8Status comment: Patches available from upstream => (none)Assignee: python => qa-bugsWhiteboard: MGA8TOO => (none)CC: (none) => mageia
openSUSE has issued an advisory for this today (January 20): https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LQS3J3J4254A7C3LD55D7A432FZ2RFFI/ python3-numpy-devel-1.19.4-1.1.mga8 python3-numpy-f2py-1.19.4-1.1.mga8 python3-numpy-1.19.4-1.1.mga8 python3-numpy-doc-1.19.4-1.1.mga8 from python-numpy-1.19.4-1.1.mga8.src.rpm
Updated python-numpy on x86_64 hardware and installed the other three packages. The requires list contains these: blender kismet nanovna-saver noethys orange pitivi .... task-sugar theli veusz xmds One could guess that blender might use this package for computing two-dimensional matrices but that requires some prior knowledge. Installed blender and ran strace on it. Nothing there after an attempt to create a shape and save it. Tried pitivi on a short file without understanding the interface and scored a few hits of this kind: openat(AT_FDCWD, "/usr/lib64/python3.8/site-packages/numpy/core/__pycache__/__init__.cpython-38.pyc", O_RDONLY|O_CLOEXEC) = 13 openat(AT_FDCWD, "/usr/lib64/python3.8/site-packages/numpy/core", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 13 openat(AT_FDCWD, "/usr/lib64/python3.8/site-packages/numpy/core/__pycache__/multiarray.cpython-38.pyc", O_RDONLY|O_CLOEXEC) = 13 theli, veusz and xdms are used in various advanced technical and scientific fields. Orange appears to have something to do with data mining. So, quite difficult to see it in action. On bug 24356 this simple test worked OK, and now. $ python tutorial.py [[ 0 1 2 3 4] [ 5 6 7 8 9] [10 11 12 13 14]] (3, 5) 2 int64 8 15 <class 'numpy.ndarray'> [6 7 8] <class 'numpy.ndarray'> [[1.5 2. 3. ] [4. 5. 6. ]] [[1.+0.j 2.+0.j] [3.+0.j 4.+0.j]] [0 1 2 3] [20 29 38 47] [0 1 4 9] [ 9.12945251 -9.88031624 7.4511316 -2.62374854] [ True True False False] Passing this on the basis that pitivi appears to work with it and the demo script gives the same result as before.
Whiteboard: (none) => MGA8-64-OKCC: (none) => tarazed25
Validating.
Keywords: (none) => validated_updateCC: (none) => andrewsfarm, sysadmin-bugs
CC: (none) => davidwhodginsKeywords: (none) => advisory
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2022-0032.html
Resolution: (none) => FIXEDStatus: NEW => RESOLVED