CVE-2018-3846

Advisory

Astropy 3.0.1 updates the bundled CFITSIO library to 3.430. This is to remedy a critical security vulnerability that was identified by NASA.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

==================

Bug Fixes
---------

astropy.config
^^^^^^^^^^^^^^

astropy.constants
^^^^^^^^^^^^^^^^^

astropy.convolution
^^^^^^^^^^^^^^^^^^^

astropy.coordinates
^^^^^^^^^^^^^^^^^^^

astropy.cosmology
^^^^^^^^^^^^^^^^^

astropy.extern
^^^^^^^^^^^^^^

astropy.io.ascii
^^^^^^^^^^^^^^^^

- Fix a unicode decode error when reading a table with non-ASCII characters.
The fast C reader cannot handle unicode so the code now uses the pure-Python
reader in this case. [7103]

astropy.io.fits
^^^^^^^^^^^^^^^

- Updated the bundled CFITSIO library to 3.430. This is to remedy a critical
security vulnerability that was identified by NASA. See
``cextern/cfitsio/docs/changes.txt`` for additional information. [7274]

astropy.io.misc
^^^^^^^^^^^^^^^

- Make sure that a sufficiently recent version of ASDF is installed when
running test suite against ASDF tags and schemas. [7205]

astropy.io.registry
^^^^^^^^^^^^^^^^^^^

- Fix reading files with serialized metadata when using a Table subclass. [7213]

astropy.io.votable
^^^^^^^^^^^^^^^^^^

- Fix lookup fields by ID. [7208]

astropy.modeling
^^^^^^^^^^^^^^^^

- Fix model set evaluation over common input when model_set_axis > 0. [7222]

astropy.nddata
^^^^^^^^^^^^^^

astropy.samp
^^^^^^^^^^^^

astropy.stats
^^^^^^^^^^^^^

astropy.table
^^^^^^^^^^^^^

astropy.tests
^^^^^^^^^^^^^

astropy.time
^^^^^^^^^^^^

astropy.units
^^^^^^^^^^^^^

- ``quantity_helper`` no longer requires ``scipy>=0.18``. [7219]

astropy.utils
^^^^^^^^^^^^^

astropy.visualization
^^^^^^^^^^^^^^^^^^^^^

astropy.wcs
^^^^^^^^^^^

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3846