ISISComputingGroup / IBEX

Top level repository for IBEX stories
5 stars 2 forks source link

LSi Correlator: Update Numpy Dependency to 1.21 or Later #6968

Open JackEAllen opened 2 years ago

JackEAllen commented 2 years ago

Where?

Where is the issue likely to be (be as specific as possible e.g. filepaths)

LSi Correlator Repository in the following locations:

How?

How did the issue come about/known cause of issue if any? (delete subheader if not applicable)

GitHub Dependabot alert found a vulnerability in repository dependencies. The Vulnerability is inside Numpy versions >= 1.9.0, < 1.21.

The vulnerability is patched in version: 1.21

A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service. - GitHub Dependabot Alert

This vulnerability is not used in the LSi Correlator repository so the vulnerability does not directly affect the repository.

It is however still good practice remove the potential of this vulnerability affecting the repositories security going forward should a need to use the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code.

We should update the dependency to Numpy version 1.21 or later to resolve this problem and update on any machines which use the LSi Correlator.

Reproducible?

Yes

To Reproduce

Acceptance criteria

How to Test

_verbose instructions for reviewer to test changes

ThomasLohnert commented 2 years ago

Will be done as part of dependency update ticket.