{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:61e8049b-1f55-52c8-a899-c470970d543c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "numpy", "purl": "pkg:pypi/numpy@2.2.6.post1+tuxcare", "type": "library", "bom-ref": "pkg:pypi/numpy@2.2.6.post1+tuxcare", "version": "2.2.6.post1+tuxcare", "pedigree": { "ancestors": [ { "name": "numpy", "purl": "pkg:pypi/numpy@2.2.6", "type": "library", "version": "2.2.6" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-1858", "affects": [ { "ref": "pkg:pypi/numpy@2.2.6.post1+tuxcare" } ], "bom-ref": "urn:uuid:cf22b93e-84af-5106-8d54-846c19cf5db9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1858 does not affect version 2.2.6.post1+tuxcare of numpy. not_affected \u2014 NumPy 2.2.6 is not affected by CVE-2014-1858. The vulnerable mktemp() usage that allowed symlink attacks on temporary files was removed by upstream commit 0bb46c1448 (authored by Julian Taylor) before NumPy 2.2.6 was released. The fix replaced insecure tempfile.mktemp() calls with secure alternatives: NamedTemporaryFile() in numpy/f2py/__init__.py and mkdtemp() in numpy/f2py/f2py2e.py. The vuln...", "justification": "code_not_present" } }, { "id": "CVE-2014-1859", "affects": [ { "ref": "pkg:pypi/numpy@2.2.6.post1+tuxcare" } ], "bom-ref": "urn:uuid:b872921f-1d9a-5fad-a953-ebf3f9fa332e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1859 does not affect version 2.2.6.post1+tuxcare of numpy. not_affected \u2014 CVE-2014-1859 is NOT present in NumPy 2.2.6. The vulnerability was fixed by upstream in NumPy 1.8.1 (February 2014) via commit 0bb46c1448 by Julian Taylor. All insecure tempfile.mktemp() calls have been replaced with secure alternatives (NamedTemporaryFile(), mkdtemp()). The fix was already included in the upstream release 2.2.6 that TuxCare onboarded, making this an upstream-provided fix rathe...", "justification": "code_not_present" } }, { "id": "CVE-2017-12852", "affects": [ { "ref": "pkg:pypi/numpy@2.2.6.post1+tuxcare" } ], "bom-ref": "urn:uuid:69d6e54d-4f4c-5f4b-ac7f-b1e8a1d287ee", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12852 does not affect version 2.2.6.post1+tuxcare of numpy. The numpy.pad infinite loop on empty arrays was fixed in 1.13.2; the numpy.pad implementation in v2.2.6 raises \"can't extend empty axis ... using modes other than constant or empty\" instead of looping. Verified by hand (PYELS-212).", "justification": "code_not_present" } }, { "id": "CVE-2019-6446", "affects": [ { "ref": "pkg:pypi/numpy@2.2.6.post1+tuxcare" } ], "bom-ref": "urn:uuid:ac55d872-59ee-5e57-9e3a-f8a9b2d78a45", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-6446 does not affect version 2.2.6.post1+tuxcare of numpy. numpy.load() defaults to allow_pickle=False since 1.16.3 (a4df7e51); v2.2.6 keeps that default, so unpickling untrusted data requires the caller to opt in explicitly. Verified by hand (PYELS-212).", "justification": "requires_configuration" } }, { "id": "CVE-2021-33430", "affects": [ { "ref": "pkg:pypi/numpy@2.2.6.post1+tuxcare" } ], "bom-ref": "urn:uuid:260e12af-35f1-5f78-9bb7-0ae709befb06", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-33430 does not affect version 2.2.6.post1+tuxcare of numpy. not_affected \u2014 CVE-2021-33430 (buffer overflow in PyArray_NewFromDescr_int with large dimensions) is NOT present in NumPy 2.2.6. The upstream fix (commit 16f7824b4d9, May 2021) was already included in the upstream release that TuxCare onboarded. The dimension validation check correctly appears BEFORE the subarray processing block at lines 654-659 of numpy/_core/src/multiarray/ctors.c, preventing buffer overfl...", "justification": "code_not_present" } }, { "id": "CVE-2021-34141", "affects": [ { "ref": "pkg:pypi/numpy@2.2.6.post1+tuxcare" } ], "bom-ref": "urn:uuid:214360e8-26b3-5bb6-879c-3f6db54f7da4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-34141 does not affect version 2.2.6.post1+tuxcare of numpy. not_affected \u2014 CVE-2021-34141 describes an incomplete string comparison vulnerability in NumPy's dtype parsing where strncmp() only checked string prefixes, allowing crafted strings like \"Bytes0ATTACK\" to bypass validation. The upstream fix (commit eeef9d4646) removed this vulnerable code and shipped in NumPy 1.22.0. Target version 2.2.6 includes this upstream fix - the vulnerable strncmp loop and deprecated ...", "justification": "code_not_present" } }, { "id": "CVE-2021-41495", "affects": [ { "ref": "pkg:pypi/numpy@2.2.6.post1+tuxcare" } ], "bom-ref": "urn:uuid:0b54a1c7-f431-5f9f-8a89-f460ab592aa2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-41495 does not affect version 2.2.6.post1+tuxcare of numpy. not_affected \u2014 CVE-2021-41495 (NULL pointer dereference in PyArray_DescrNew) is NOT present in NumPy 2.2.6. The vulnerability was fixed by upstream commit ac87f071f5 (PR #20960 by Matti Picus, Feb 2022) which added NULL validation after all PyArray_DescrNew* calls. This fix was already included in the NumPy 2.2.6 release that TuxCare onboarded (commit ea793b50ff). Comprehensive verification confirms NULL chec...", "justification": "code_not_present" } }, { "id": "CVE-2021-41496", "affects": [ { "ref": "pkg:pypi/numpy@2.2.6.post1+tuxcare" } ], "bom-ref": "urn:uuid:2db9bbbb-aac6-54f6-8291-3c514fdfaaaa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-41496 does not affect version 2.2.6.post1+tuxcare of numpy. Upstream fix 271010f103 (f2py array_from_pyobj message via PyErr_Format, gh-19000) is an ancestor of v2.2.6. Verified by hand (PYELS-212).", "justification": "code_not_present" } }, { "id": "TUXVUL-2026-10002", "affects": [ { "ref": "pkg:pypi/numpy@2.2.6.post1+tuxcare" } ], "bom-ref": "urn:uuid:7bcccf94-8686-5638-822b-3350b12b2b3a", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10002 is fixed in version 2.2.6.post1+tuxcare of numpy." } }, { "id": "TUXVUL-2026-10003", "affects": [ { "ref": "pkg:pypi/numpy@2.2.6.post1+tuxcare" } ], "bom-ref": "urn:uuid:2c446ce3-5a8e-5f13-9fc7-006d59b699f3", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10003 is fixed in version 2.2.6.post1+tuxcare of numpy." } }, { "id": "TUXVUL-2026-10004", "affects": [ { "ref": "pkg:pypi/numpy@2.2.6.post1+tuxcare" } ], "bom-ref": "urn:uuid:01496be2-a662-5699-92e9-5f084102809e", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10004 is fixed in version 2.2.6.post1+tuxcare of numpy." } }, { "id": "TUXVUL-2026-10005", "affects": [ { "ref": "pkg:pypi/numpy@2.2.6.post1+tuxcare" } ], "bom-ref": "urn:uuid:6c7db666-dbca-56c3-a1be-16e17aa5d05e", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10005 is fixed in version 2.2.6.post1+tuxcare of numpy." } }, { "id": "TUXVUL-2026-10006", "affects": [ { "ref": "pkg:pypi/numpy@2.2.6.post1+tuxcare" } ], "bom-ref": "urn:uuid:bf152f94-4cf6-50ca-8e6d-77da13e6d887", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10006 is fixed in version 2.2.6.post1+tuxcare of numpy." } }, { "id": "TUXVUL-2026-10007", "affects": [ { "ref": "pkg:pypi/numpy@2.2.6.post1+tuxcare" } ], "bom-ref": "urn:uuid:9070c3e9-9090-5b37-b045-2eb8492fcbd4", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10007 is fixed in version 2.2.6.post1+tuxcare of numpy." } }, { "id": "TUXVUL-2026-10008", "affects": [ { "ref": "pkg:pypi/numpy@2.2.6.post1+tuxcare" } ], "bom-ref": "urn:uuid:8e91d538-80b5-5e10-90fe-0b61c492242b", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10008 is fixed in version 2.2.6.post1+tuxcare of numpy." } } ], "dependencies": [ { "ref": "pkg:pypi/numpy@2.2.6.post1+tuxcare" } ] }