This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-41500 →

DEBIAN-CVE-2021-41500

Incomplete string comparison vulnerability exits in cvxopt.org cvxop

Original description

The description as published by the source.

Incomplete string comparison vulnerability exits in cvxopt.org cvxop <= 1.2.6 in APIs (cvxopt.cholmod.diag, cvxopt.cholmod.getfactor, cvxopt.cholmod.solve, cvxopt.cholmod.spsolve), which allows attackers to conduct Denial of Service attacks by construct fake Capsule objects.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 cvxopt

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7+dfsg-1"}]}]

Debian:13 cvxopt

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7+dfsg-1"}]}]

Debian:14 cvxopt

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7+dfsg-1"}]}]

References

advisory security-tracker.debian.org