{
  "@id": "urn:uuid:f39f13b6-ffc5-4000-85a2-6d5aba62e85a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T22:20:21.477460+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/numpy@1.21.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/numpy@1.21.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T22:13:00.146708+00:00",
      "status_notes": "Vulnerability CVE-2014-1858 does not affect version 1.21.0.post1+tuxcare of numpy. not_affected \u2014 CVE-2014-1858 is not present in numpy 1.21.0. The vulnerability involved insecure use of tempfile.mktemp() in f2py that allowed symlink attacks. The fix (commit 0bb46c1448) was applied upstream by Julian Taylor on 2014-02-05 and shipped in numpy 1.8.1. The target version (1.21.0, released 2021) contains the fix as part of the upstream release. Both vulnerable locations now use secure alternativ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-1858"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-1858 is not present in numpy 1.21.0. The vulnerability involved insecure use of tempfile.mktemp() in f2py that allowed symlink attacks. The fix (commit 0bb46c1448) was applied upstream by Julian Taylor on 2014-02-05 and shipped in numpy 1.8.1. The target version (1.21.0, released 2021) contains the fix as part of the upstream release. Both vulnerable locations now use secure alternativ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/numpy@1.21.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/numpy@1.21.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T22:20:21.477460+00:00",
      "status_notes": "Vulnerability CVE-2014-1859 does not affect version 1.21.0.post1+tuxcare of numpy. not_affected \u2014 The target NumPy version 1.21.0.post1+tuxcare is NOT affected by CVE-2014-1859. The vulnerable pattern (insecure tempfile.mktemp() usage) was removed by upstream commit 0bb46c1448 in February 2014, well before version 1.21.0 was released (June 2021). All affected files now use secure alternatives: NamedTemporaryFile(), mkdtemp(), and mkstemp(). Comprehensive searches confirm zero mktemp usage i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-1859"
      },
      "impact_statement": "not_affected \u2014 The target NumPy version 1.21.0.post1+tuxcare is NOT affected by CVE-2014-1859. The vulnerable pattern (insecure tempfile.mktemp() usage) was removed by upstream commit 0bb46c1448 in February 2014, well before version 1.21.0 was released (June 2021). All affected files now use secure alternatives: NamedTemporaryFile(), mkdtemp(), and mkstemp(). Comprehensive searches confirm zero mktemp usage i..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/numpy@1.21.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/numpy@1.21.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T19:13:55.687660+00:00",
      "status_notes": "Vulnerability CVE-2017-12852 affects version 1.21.0.post1+tuxcare of numpy.",
      "vulnerability": {
        "name": "CVE-2017-12852"
      },
      "action_statement": "Vulnerability CVE-2017-12852 affects version 1.21.0.post1+tuxcare of numpy."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/numpy@1.21.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/numpy@1.21.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T19:09:04.720419+00:00",
      "status_notes": "Vulnerability CVE-2019-6446 affects version 1.21.0.post1+tuxcare of numpy.",
      "vulnerability": {
        "name": "CVE-2019-6446"
      },
      "action_statement": "Vulnerability CVE-2019-6446 affects version 1.21.0.post1+tuxcare of numpy."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/numpy@1.21.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/numpy@1.21.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T17:53:00.139615+00:00",
      "status_notes": "Vulnerability CVE-2021-33430 does not affect version 1.21.0.post1+tuxcare of numpy. not_affected \u2014 NumPy 1.21.0 is not affected by CVE-2021-33430. The vulnerability was a buffer overflow in PyArray_NewFromDescr_int when processing arrays with dimensions exceeding NPY_MAXDIMS (32). The issue occurred because dimension validation happened AFTER entering code paths that used fixed-size buffers. The upstream fix (commit 16f7824b4d) moved dimension validation to occur immediately at function entr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-33430"
      },
      "impact_statement": "not_affected \u2014 NumPy 1.21.0 is not affected by CVE-2021-33430. The vulnerability was a buffer overflow in PyArray_NewFromDescr_int when processing arrays with dimensions exceeding NPY_MAXDIMS (32). The issue occurred because dimension validation happened AFTER entering code paths that used fixed-size buffers. The upstream fix (commit 16f7824b4d) moved dimension validation to occur immediately at function entr..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/numpy@1.21.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/numpy@1.21.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-34141 is fixed in version 1.21.0.post1+tuxcare of numpy.",
      "vulnerability": {
        "name": "CVE-2021-34141"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/numpy@1.21.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/numpy@1.21.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T19:03:44.920105+00:00",
      "status_notes": "Vulnerability CVE-2021-41495 affects version 1.21.0.post1+tuxcare of numpy.",
      "vulnerability": {
        "name": "CVE-2021-41495"
      },
      "action_statement": "Vulnerability CVE-2021-41495 affects version 1.21.0.post1+tuxcare of numpy."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/numpy@1.21.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/numpy@1.21.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T19:03:44.920105+00:00",
      "status_notes": "Vulnerability CVE-2021-41496 affects version 1.21.0.post1+tuxcare of numpy.",
      "vulnerability": {
        "name": "CVE-2021-41496"
      },
      "action_statement": "Vulnerability CVE-2021-41496 affects version 1.21.0.post1+tuxcare of numpy."
    }
  ]
}