CVE-2017-12852 - Vulnerability Details - OpenCVE

The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00619.

Key SSVC decision points have not yet been added.

Vendors	Products
Numpy	Numpy

Configuration 1 [-]

cpe:2.3:a:numpy:numpy:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2017-0080	The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.
Github GHSA	GHSA-frgw-fgh6-9g52	Numpy missing input validation

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/BT123/testcasesForMyRequest/tree/master/CVE-2017-12852
https://github.com/numpy/numpy/issues/9560#issuecomment-322395292
https://nvd.nist.gov/vuln/detail/CVE-2017-12852
https://www.cve.org/CVERecord?id=CVE-2017-12852

History

Sat, 12 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00721}`	epss `{'score': 0.00526}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2017-08-15T16:00:00

Updated: 2024-08-05T18:51:06.687Z

Reserved: 2017-08-14T00:00:00

Link: CVE-2017-12852

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2017-08-15T16:29:00.200

Modified: 2025-04-20T01:37:25.860

Link: CVE-2017-12852

Redhat

Severity : Low

Publid Date: 2017-08-15T00:00:00Z

Links: CVE-2017-12852 - Bugzilla

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2017-08-14T00:00:00", "descriptions": [{"lang": "en", "value": "The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-02-28T21:57:02", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/BT123/testcasesForMyRequest/tree/master/CVE-2017-12852"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/numpy/numpy/issues/9560#issuecomment-322395292"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-12852", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/BT123/testcasesForMyRequest/tree/master/CVE-2017-12852", "refsource": "MISC", "url": "https://github.com/BT123/testcasesForMyRequest/tree/master/CVE-2017-12852"}, {"name": "https://github.com/numpy/numpy/issues/9560#issuecomment-322395292", "refsource": "CONFIRM", "url": "https://github.com/numpy/numpy/issues/9560#issuecomment-322395292"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T18:51:06.687Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/BT123/testcasesForMyRequest/tree/master/CVE-2017-12852"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/numpy/numpy/issues/9560#issuecomment-322395292"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-12852", "datePublished": "2017-08-15T16:00:00", "dateReserved": "2017-08-14T00:00:00", "dateUpdated": "2024-08-05T18:51:06.687Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:numpy:numpy:*:*:*:*:*:*:*:*", "matchCriteriaId": "516F3D03-E951-43EA-A475-CB22E2833667", "versionEndIncluding": "1.13.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack."}, {"lang": "es", "value": "La funci\u00f3n numpy.pad en Numpy 1.13.1 y versiones anteriores no cuenta con validaci\u00f3n de entrada. Una lista vac\u00eda o ndarray entrar\u00e1 en un bucle infinito, lo que puede propiciar que los atacantes provoquen un ataque DoS."}], "id": "CVE-2017-12852", "lastModified": "2025-04-20T01:37:25.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": true, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-08-15T16:29:00.200", "references": [{"source": "cve@mitre.org", "url": "https://github.com/BT123/testcasesForMyRequest/tree/master/CVE-2017-12852"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/numpy/numpy/issues/9560#issuecomment-322395292"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/BT123/testcasesForMyRequest/tree/master/CVE-2017-12852"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/numpy/numpy/issues/9560#issuecomment-322395292"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-835"}], "source": "nvd@nist.gov", "type": "Primary"}]}