{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9801e55e-4240-541b-8d21-d5037d8d45ec", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "numpy", "purl": "pkg:pypi/numpy@2.0.2.post1+tuxcare", "type": "library", "bom-ref": "pkg:pypi/numpy@2.0.2.post1+tuxcare", "version": "2.0.2.post1+tuxcare", "pedigree": { "ancestors": [ { "name": "numpy", "purl": "pkg:pypi/numpy@2.0.2", "type": "library", "version": "2.0.2" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-1858", "affects": [ { "ref": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } ], "bom-ref": "urn:uuid:fd13f235-bb11-597e-9071-c024d3db3edb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1858 does not affect version 2.0.2.post1+tuxcare of numpy. not_affected \u2014 CVE-2014-1858 is not present in NumPy 2.0.2.post1+tuxcare. The vulnerability concerned insecure use of tempfile.mktemp() in f2py that allowed symlink attacks. The fix (commit 0bb46c1448 by Julian Taylor) replaced mktemp() with secure alternatives (NamedTemporaryFile/mkdtemp) and was already included in the upstream NumPy 2.0.2 release that TuxCare onboarded. Comprehensive search confirms no ins...", "justification": "code_not_present" } }, { "id": "CVE-2014-1859", "affects": [ { "ref": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } ], "bom-ref": "urn:uuid:4235ba2a-841b-5152-bf83-549cc5c28774", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1859 does not affect version 2.0.2.post1+tuxcare of numpy. not_affected \u2014 CVE-2014-1859 is not present in NumPy 2.0.2.post1+tuxcare. The vulnerability (symlink attack via insecure tempfile.mktemp() usage) was fixed by upstream NumPy in commit 0bb46c1448 (Feb 2014) by Julian Taylor, replacing mktemp() with atomic file creation functions (NamedTemporaryFile, mkdtemp). This fix was already present in the upstream NumPy 2.0.2 release when TuxCare onboarded it in April 20...", "justification": "code_not_present" } }, { "id": "CVE-2017-12852", "affects": [ { "ref": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } ], "bom-ref": "urn:uuid:01130440-e706-5a99-988d-e6c1a9f27e5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-12852 affects version 2.0.2.post1+tuxcare of numpy." } }, { "id": "CVE-2019-6446", "affects": [ { "ref": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } ], "bom-ref": "urn:uuid:9631344f-8d67-5c59-be91-f33d685f7a15", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-6446 affects version 2.0.2.post1+tuxcare of numpy." } }, { "id": "CVE-2021-33430", "affects": [ { "ref": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } ], "bom-ref": "urn:uuid:3bb5035b-c406-5018-ae69-6617a562bb1f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-33430 does not affect version 2.0.2.post1+tuxcare of numpy. not_affected \u2014 CVE-2021-33430 is not present in NumPy 2.0.2. The vulnerability (buffer overflow in PyArray_NewFromDescr_int when processing arrays with excessive dimensions) was fixed in upstream commit 16f7824b4d (May 2021) by moving dimension validation before subarray buffer access. This fix was already included in the upstream NumPy 2.0.2 release that TuxCare onboarded. The target code at numpy/_core/src/...", "justification": "code_not_present" } }, { "id": "CVE-2021-34141", "affects": [ { "ref": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } ], "bom-ref": "urn:uuid:e7e6d977-2bf0-5a02-a980-5b61d826fcf8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-34141 does not affect version 2.0.2.post1+tuxcare of numpy. not_affected \u2014 CVE-2021-34141 describes an incomplete string comparison vulnerability in NumPy's dtype parsing that allowed attackers to bypass validation using crafted strings with matching prefixes (e.g., \"Bytes123\" matching \"Bytes\"). The target repository (NumPy 2.0.2.post1+tuxcare) is not affected because the vulnerable code was completely removed by upstream commit eeef9d4646103c3b1afd3085f1393f2b3f9575b...", "justification": "code_not_present" } }, { "id": "CVE-2021-41495", "affects": [ { "ref": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } ], "bom-ref": "urn:uuid:b9062b69-2207-5ba3-a371-894003ae8972", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-41495 does not affect version 2.0.2.post1+tuxcare of numpy. not_affected \u2014 CVE-2021-41495 is NOT present in numpy 2.0.2. The vulnerability (null pointer dereference due to missing return-value validation for PyArray_DescrNew and related functions) was fixed upstream in commit ac87f071f5 (Feb 2022, PR #20960). This fix was already included in the upstream numpy 2.0.2 release (July 2024) that TuxCare onboarded in April 2026. All required NULL checks are present in the t...", "justification": "code_not_present" } }, { "id": "CVE-2021-41496", "affects": [ { "ref": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } ], "bom-ref": "urn:uuid:0ca731ee-f57b-5326-a1cd-d21b22049586", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-41496 affects version 2.0.2.post1+tuxcare of numpy." } }, { "id": "TUXVUL-2026-10001", "affects": [ { "ref": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } ], "bom-ref": "urn:uuid:c5f9d2e2-6280-51f5-8da6-c689cd62618d", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10001 is fixed in version 2.0.2.post1+tuxcare of numpy." } }, { "id": "TUXVUL-2026-10002", "affects": [ { "ref": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } ], "bom-ref": "urn:uuid:119093fd-6213-53c1-84f1-cf86b933f9d8", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10002 is fixed in version 2.0.2.post1+tuxcare of numpy." } }, { "id": "TUXVUL-2026-10003", "affects": [ { "ref": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } ], "bom-ref": "urn:uuid:40a30cdd-caa9-5a46-af4a-cf1514aeb8f3", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10003 is fixed in version 2.0.2.post1+tuxcare of numpy." } }, { "id": "TUXVUL-2026-10004", "affects": [ { "ref": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } ], "bom-ref": "urn:uuid:9cbd4d81-5b72-5c73-baee-d8ef78dd1b16", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10004 is fixed in version 2.0.2.post1+tuxcare of numpy." } }, { "id": "TUXVUL-2026-10005", "affects": [ { "ref": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } ], "bom-ref": "urn:uuid:4de5dad2-b6cd-5f4c-b158-8291f35dfa6d", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10005 is fixed in version 2.0.2.post1+tuxcare of numpy." } }, { "id": "TUXVUL-2026-10006", "affects": [ { "ref": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } ], "bom-ref": "urn:uuid:107e3309-6e09-526f-99b6-ce321473e0a6", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10006 is fixed in version 2.0.2.post1+tuxcare of numpy." } }, { "id": "TUXVUL-2026-10007", "affects": [ { "ref": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } ], "bom-ref": "urn:uuid:051a8e9c-2120-5094-ade9-99a2c80bcb80", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10007 is fixed in version 2.0.2.post1+tuxcare of numpy." } }, { "id": "TUXVUL-2026-10008", "affects": [ { "ref": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } ], "bom-ref": "urn:uuid:f43ae433-adc0-5f49-8ebc-cab352ab10a5", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10008 is fixed in version 2.0.2.post1+tuxcare of numpy." } } ], "dependencies": [ { "ref": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } ] }