{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f1242675-ead6-5e9a-9c93-ca9437cef48b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "numpy", "purl": "pkg:pypi/numpy@2.1.3.post1+tuxcare", "type": "library", "bom-ref": "pkg:pypi/numpy@2.1.3.post1+tuxcare", "version": "2.1.3.post1+tuxcare", "pedigree": { "ancestors": [ { "name": "numpy", "purl": "pkg:pypi/numpy@2.1.3", "type": "library", "version": "2.1.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-1858", "affects": [ { "ref": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } ], "bom-ref": "urn:uuid:b35d2b87-ca49-58ed-89a8-e0fe3b094075", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1858 does not affect version 2.1.3.post1+tuxcare of numpy. not_affected \u2014 CVE-2014-1858 concerns a symlink attack vulnerability in NumPy's f2py component where tempfile.mktemp() created a race condition allowing local attackers to write to arbitrary files. The vulnerability was fixed in upstream commit 0bb46c1448 by Julian Taylor, replacing insecure mktemp() with secure NamedTemporaryFile() and mkdtemp(). This fix was already present in upstream NumPy 2.1.3 when TuxC...", "justification": "code_not_present" } }, { "id": "CVE-2014-1859", "affects": [ { "ref": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } ], "bom-ref": "urn:uuid:13c46633-e7cc-5c66-a310-f3fea562b4d3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1859 does not affect version 2.1.3.post1+tuxcare of numpy. not_affected \u2014 CVE-2014-1859 affects NumPy versions before 1.8.1 via insecure tempfile.mktemp() usage that allows symlink attacks. The target repository (NumPy 2.1.3.post1+tuxcare) is NOT AFFECTED because the vulnerability was fixed upstream in commit 0bb46c1448 (Feb 2014) by Julian Taylor, replacing mktemp() with secure alternatives (NamedTemporaryFile, mkdtemp, pytest fixtures). This fix shipped with the up...", "justification": "code_not_present" } }, { "id": "CVE-2017-12852", "affects": [ { "ref": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } ], "bom-ref": "urn:uuid:b0982609-10cd-56c7-8f2b-2978ab502a5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-12852 affects version 2.1.3.post1+tuxcare of numpy." } }, { "id": "CVE-2019-6446", "affects": [ { "ref": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } ], "bom-ref": "urn:uuid:36f97e1e-31a8-5c37-b8f4-c9421212a7a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-6446 affects version 2.1.3.post1+tuxcare of numpy." } }, { "id": "CVE-2021-33430", "affects": [ { "ref": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } ], "bom-ref": "urn:uuid:9e0b4d04-196a-5fea-9e8b-d82d8b2070de", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-33430 does not affect version 2.1.3.post1+tuxcare of numpy. not_affected \u2014 CVE-2021-33430 does not affect NumPy 2.1.3. The buffer overflow vulnerability in PyArray_NewFromDescr_int when handling arrays with large dimensions (>32) was fixed upstream in May 2021 (commit 16f7824b4d9). The fix moved dimension validation before subarray processing that uses fixed-size stack buffers. This fix was already present in the upstream NumPy 2.1.3 release that TuxCare onboarded, so...", "justification": "code_not_present" } }, { "id": "CVE-2021-34141", "affects": [ { "ref": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } ], "bom-ref": "urn:uuid:5985ac38-22f6-5c2b-b033-997826ac98d7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-34141 does not affect version 2.1.3.post1+tuxcare of numpy. not_affected \u2014 CVE-2021-34141 affects NumPy's dtype string parsing with an insecure prefix-matching pattern using strncmp. The vulnerability allowed attackers to bypass validation by crafting strings like \"Bytes0xxx\" that would match deprecated type names through prefix comparison only. The target repository (NumPy 2.1.3.post1+tuxcare) is NOT AFFECTED because the vulnerable code was removed by upstream commit...", "justification": "code_not_present" } }, { "id": "CVE-2021-41495", "affects": [ { "ref": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } ], "bom-ref": "urn:uuid:1db8cb3a-0d4b-56e0-9082-a746cf5afe31", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-41495 does not affect version 2.1.3.post1+tuxcare of numpy. not_affected \u2014 Target NumPy 2.1.3 is not affected by CVE-2021-41495. The vulnerability (missing NULL pointer validation after PyArray_DescrNew* calls) was fixed in upstream commit ac87f071f5 (Feb 2022) by Matti Picus, which was already included in the upstream NumPy 2.1.3 release that TuxCare onboarded. All critical code paths (methods.c array_sort, getset.c _get_part, descriptor.c, ctors.c) contain the requi...", "justification": "code_not_present" } }, { "id": "CVE-2021-41496", "affects": [ { "ref": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } ], "bom-ref": "urn:uuid:4aa59554-a070-5818-a341-1272d9efbc76", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-41496 affects version 2.1.3.post1+tuxcare of numpy." } }, { "id": "TUXVUL-2026-10001", "affects": [ { "ref": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } ], "bom-ref": "urn:uuid:7ba7eb23-3cf6-522a-a600-80ab93294fd9", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10001 is fixed in version 2.1.3.post1+tuxcare of numpy." } }, { "id": "TUXVUL-2026-10002", "affects": [ { "ref": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } ], "bom-ref": "urn:uuid:aaecc3d5-148e-5f9e-9bb1-d67c3d09d2c2", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10002 is fixed in version 2.1.3.post1+tuxcare of numpy." } }, { "id": "TUXVUL-2026-10003", "affects": [ { "ref": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } ], "bom-ref": "urn:uuid:79ee0321-0888-5bb5-945b-070f14214649", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10003 is fixed in version 2.1.3.post1+tuxcare of numpy." } }, { "id": "TUXVUL-2026-10004", "affects": [ { "ref": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } ], "bom-ref": "urn:uuid:d5fafba6-8528-5cf6-a979-7ce9cf2a56a1", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10004 is fixed in version 2.1.3.post1+tuxcare of numpy." } }, { "id": "TUXVUL-2026-10005", "affects": [ { "ref": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } ], "bom-ref": "urn:uuid:782c6389-78f4-506d-af29-6f609a3d212e", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10005 is fixed in version 2.1.3.post1+tuxcare of numpy." } }, { "id": "TUXVUL-2026-10006", "affects": [ { "ref": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } ], "bom-ref": "urn:uuid:7d328655-c2c8-5f4d-bcd0-12b87cac68b0", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10006 is fixed in version 2.1.3.post1+tuxcare of numpy." } }, { "id": "TUXVUL-2026-10007", "affects": [ { "ref": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } ], "bom-ref": "urn:uuid:615f57d7-751e-5d3d-b2ec-e31afc86cc7b", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10007 is fixed in version 2.1.3.post1+tuxcare of numpy." } }, { "id": "TUXVUL-2026-10008", "affects": [ { "ref": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } ], "bom-ref": "urn:uuid:4debe837-7c8c-5040-a795-8b0775195b58", "analysis": { "state": "resolved", "detail": "Vulnerability TUXVUL-2026-10008 is fixed in version 2.1.3.post1+tuxcare of numpy." } } ], "dependencies": [ { "ref": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } ] }