{
  "@id": "urn:uuid:d99eea4e-054e-4f75-a19c-7248aadc9930",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T22:24:00.191135+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/numpy@1.15.4.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/numpy@1.15.4.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T22:12:00.150579+00:00",
      "status_notes": "Vulnerability CVE-2014-1858 does not affect version 1.15.4.post4+tuxcare of numpy. not_affected \u2014 CVE-2014-1858 is NOT present in NumPy 1.15.4. The vulnerability involved insecure use of tempfile.mktemp() in numpy/f2py/__init__.py and numpy/f2py/f2py2e.py, which allowed local users to conduct symlink attacks on predictable temporary filenames. The fix (commit 0bb46c1448) replaced mktemp() with secure alternatives: NamedTemporaryFile() and mkdtemp() which atomically create files/directories....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-1858"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-1858 is NOT present in NumPy 1.15.4. The vulnerability involved insecure use of tempfile.mktemp() in numpy/f2py/__init__.py and numpy/f2py/f2py2e.py, which allowed local users to conduct symlink attacks on predictable temporary filenames. The fix (commit 0bb46c1448) replaced mktemp() with secure alternatives: NamedTemporaryFile() and mkdtemp() which atomically create files/directories...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/numpy@1.15.4.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/numpy@1.15.4.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T22:24:00.191135+00:00",
      "status_notes": "Vulnerability CVE-2014-1859 does not affect version 1.15.4.post4+tuxcare of numpy. not_affected \u2014 NumPy 1.15.4 is not affected by CVE-2014-1859. The original vulnerability (insecure mktemp usage allowing symlink attacks) was fixed by upstream in February 2014 before the 1.8.1 release. Production f2py code uses secure methods (NamedTemporaryFile/mkdtemp). Test code uses mktemp within mkdtemp()-created directories with 0o700 permissions, providing runtime protection against the CVE's cross-us...",
      "vulnerability": {
        "name": "CVE-2014-1859"
      },
      "impact_statement": "not_affected \u2014 NumPy 1.15.4 is not affected by CVE-2014-1859. The original vulnerability (insecure mktemp usage allowing symlink attacks) was fixed by upstream in February 2014 before the 1.8.1 release. Production f2py code uses secure methods (NamedTemporaryFile/mkdtemp). Test code uses mktemp within mkdtemp()-created directories with 0o700 permissions, providing runtime protection against the CVE's cross-us..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/numpy@1.15.4.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/numpy@1.15.4.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T19:13:55.687660+00:00",
      "status_notes": "Vulnerability CVE-2017-12852 affects version 1.15.4.post4+tuxcare of numpy.",
      "vulnerability": {
        "name": "CVE-2017-12852"
      },
      "action_statement": "Vulnerability CVE-2017-12852 affects version 1.15.4.post4+tuxcare of numpy."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/numpy@1.15.4.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/numpy@1.15.4.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2019-6446 is fixed in version 1.15.4.post4+tuxcare of numpy.",
      "vulnerability": {
        "name": "CVE-2019-6446"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/numpy@1.15.4.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/numpy@1.15.4.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-33430 is fixed in version 1.15.4.post4+tuxcare of numpy.",
      "vulnerability": {
        "name": "CVE-2021-33430"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/numpy@1.15.4.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/numpy@1.15.4.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2021-34141 is fixed in version 1.15.4.post4+tuxcare of numpy.",
      "vulnerability": {
        "name": "CVE-2021-34141"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/numpy@1.15.4.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/numpy@1.15.4.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-41495 is fixed in version 1.15.4.post4+tuxcare of numpy.",
      "vulnerability": {
        "name": "CVE-2021-41495"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/numpy@1.15.4.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/numpy@1.15.4.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-07T10:48:00.634805+00:00",
      "status_notes": "Vulnerability CVE-2021-41496 affects version 1.15.4.post4+tuxcare of numpy, and is fixed in 1.15.4.post5+tuxcare.",
      "vulnerability": {
        "name": "CVE-2021-41496"
      },
      "action_statement": "Vulnerability CVE-2021-41496 affects version 1.15.4.post4+tuxcare of numpy, and is fixed in 1.15.4.post5+tuxcare."
    }
  ]
}