An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is completely harmless.
The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Numpy | Numpy | * | 1.22.0 (excluding) |
| Numpy | Ubuntu | focal | * |
| Numpy | Ubuntu | hirsute | * |
| Numpy | Ubuntu | impish | * |
| Numpy | Ubuntu | jammy | * |
| Numpy | Ubuntu | kinetic | * |
| Numpy | Ubuntu | trusty | * |
| Numpy | Ubuntu | upstream | * |
| Numpy | Ubuntu | xenial | * |
This Pillar covers several possibilities: