CVE-2021-41500

Advisory

Incomplete string comparison vulnerability exits in cvxopt.org cvxop <= 1.2.6 in APIs (cvxopt.cholmod.diag, cvxopt.cholmod.getfactor, cvxopt.cholmod.solve, cvxopt.cholmod.spsolve), which allows attackers to conduct Denial of Service attacks by construct fake Capsule objects.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-8rh6-h94m-vj54
• https://nvd.nist.gov/vuln/detail/CVE-2021-41500
• https://github.com/cvxopt/cvxopt/issues/193
• https://github.com/cvxopt/cvxopt/commit/d5a21cf1da62e4269176384b1ff62edac5579f94
• https://github.com/cvxopt/cvxopt
• https://lists.fedoraproject.org/archives/list/[email protected]/message/CXTPM
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41500
• https://lists.fedoraproject.org/archives/list/[email protected]/message/CXTPM3DGVYTYQ54OFCMXZVWVOMR7JM2D/