{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1c7203ed-0444-5f2b-9b96-8158a0973ba0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "numpy", "purl": "pkg:pypi/numpy@1.26.4.post1+tuxcare", "type": "library", "bom-ref": "pkg:pypi/numpy@1.26.4.post1+tuxcare", "version": "1.26.4.post1+tuxcare", "pedigree": { "ancestors": [ { "name": "numpy", "purl": "pkg:pypi/numpy@1.26.4", "type": "library", "version": "1.26.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-1858", "affects": [ { "ref": "pkg:pypi/numpy@1.26.4.post1+tuxcare" } ], "bom-ref": "urn:uuid:c92b5a1e-97ae-5dcc-83fb-5ad80e416c20", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1858 does not affect version 1.26.4.post1+tuxcare of numpy. Insecure tempfile.mktemp() in f2py was removed in numpy 1.8.1 (0bb46c1448); no mktemp() calls remain in numpy/f2py or numpy/distutils of v1.26.4. Verified by hand (PYELS-212).", "justification": "code_not_present" } }, { "id": "CVE-2014-1859", "affects": [ { "ref": "pkg:pypi/numpy@1.26.4.post1+tuxcare" } ], "bom-ref": "urn:uuid:5f48e1e1-a54b-522f-a52e-5d8afe019788", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1859 does not affect version 1.26.4.post1+tuxcare of numpy. Insecure tempfile.mktemp() usage was removed in numpy 1.8.1 (0bb46c1448); no mktemp() calls remain in numpy/f2py or numpy/distutils of v1.26.4. Verified by hand (PYELS-212).", "justification": "code_not_present" } }, { "id": "CVE-2017-12852", "affects": [ { "ref": "pkg:pypi/numpy@1.26.4.post1+tuxcare" } ], "bom-ref": "urn:uuid:ec4ec62f-ff45-5087-8529-8888aa599847", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12852 does not affect version 1.26.4.post1+tuxcare of numpy. The numpy.pad infinite loop on empty arrays was fixed in 1.13.2; v1.26.4 numpy/lib/arraypad.py raises \"can't extend empty axis ... using modes other than constant or empty\" instead of looping. Verified by hand (PYELS-212).", "justification": "code_not_present" } }, { "id": "CVE-2019-6446", "affects": [ { "ref": "pkg:pypi/numpy@1.26.4.post1+tuxcare" } ], "bom-ref": "urn:uuid:1e16c563-ee81-5309-bd86-58c01c0ba15d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-6446 does not affect version 1.26.4.post1+tuxcare of numpy. numpy.load() defaults to allow_pickle=False since 1.16.3 (a4df7e51); v1.26.4 keeps that default, so unpickling untrusted data requires the caller to opt in explicitly. Verified by hand (PYELS-212).", "justification": "requires_configuration" } }, { "id": "CVE-2021-33430", "affects": [ { "ref": "pkg:pypi/numpy@1.26.4.post1+tuxcare" } ], "bom-ref": "urn:uuid:8131af27-9234-59cd-a5f7-9a2e24542aed", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-33430 does not affect version 1.26.4.post1+tuxcare of numpy. Upstream fix 16f7824b4d (dimension validation in PyArray_NewFromDescr_int before subarray handling, numpy 1.21.0) is an ancestor of v1.26.4. Verified by hand (PYELS-212).", "justification": "code_not_present" } }, { "id": "CVE-2021-34141", "affects": [ { "ref": "pkg:pypi/numpy@1.26.4.post1+tuxcare" } ], "bom-ref": "urn:uuid:f85da492-684f-58ad-9043-8842ed3ab663", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-34141 does not affect version 1.26.4.post1+tuxcare of numpy. The Numeric-style typecode prefix check (dep_tps strncmp loop in _convert_from_str) was removed when the deprecation expired in numpy 1.22 (numpy/numpy#19539); absent from v1.26.4. Verified by hand (PYELS-212).", "justification": "code_not_present" } }, { "id": "CVE-2021-41495", "affects": [ { "ref": "pkg:pypi/numpy@1.26.4.post1+tuxcare" } ], "bom-ref": "urn:uuid:6f90e087-6df6-56f5-a7cf-a272741febc9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-41495 does not affect version 1.26.4.post1+tuxcare of numpy. Upstream fix numpy/numpy#20960 (ac87f071f5, NULL checks after PyArray_DescrNew, numpy 1.23.0) is an ancestor of v1.26.4. Verified by hand (PYELS-212).", "justification": "code_not_present" } }, { "id": "CVE-2021-41496", "affects": [ { "ref": "pkg:pypi/numpy@1.26.4.post1+tuxcare" } ], "bom-ref": "urn:uuid:6c9f994c-aa67-59f0-87f7-cf48741cdae0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-41496 does not affect version 1.26.4.post1+tuxcare of numpy. Upstream fix 271010f103 (f2py array_from_pyobj message via PyErr_Format, gh-19000) is an ancestor of v1.26.4. Verified by hand (PYELS-212).", "justification": "code_not_present" } }, { "id": "TUXVUL-2026-10004", "affects": [ { "ref": "pkg:pypi/numpy@1.26.4.post1+tuxcare" } ], "bom-ref": "urn:uuid:76e4cad2-1870-524c-a1f1-422865a2dc5d", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10004 is fixed in version 1.26.4.post1+tuxcare of numpy." } }, { "id": "TUXVUL-2026-10005", "affects": [ { "ref": "pkg:pypi/numpy@1.26.4.post1+tuxcare" } ], "bom-ref": "urn:uuid:4f2c16b3-2dbe-519f-8783-d2be23905ca5", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10005 is fixed in version 1.26.4.post1+tuxcare of numpy." } }, { "id": "TUXVUL-2026-10006", "affects": [ { "ref": "pkg:pypi/numpy@1.26.4.post1+tuxcare" } ], "bom-ref": "urn:uuid:d5c7afdb-6c56-538f-9159-e43780776988", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10006 is fixed in version 1.26.4.post1+tuxcare of numpy." } }, { "id": "TUXVUL-2026-10007", "affects": [ { "ref": "pkg:pypi/numpy@1.26.4.post1+tuxcare" } ], "bom-ref": "urn:uuid:af8910d4-a86a-5c11-b712-dd3871a7b707", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10007 is fixed in version 1.26.4.post1+tuxcare of numpy." } }, { "id": "TUXVUL-2026-10008", "affects": [ { "ref": "pkg:pypi/numpy@1.26.4.post1+tuxcare" } ], "bom-ref": "urn:uuid:eacc7941-b1d7-5e20-876c-322954f99ff2", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10008 is fixed in version 1.26.4.post1+tuxcare of numpy." } } ], "dependencies": [ { "ref": "pkg:pypi/numpy@1.26.4.post1+tuxcare" } ] }