PYSEC-2024-277

Withdrawn · 2026-06-09 16:03 UTC

At a glance

Published: 2024-05-17 19:15 UTC
Updated: 2026-06-09 17:00 UTC
CVE: CVE-2024-34997
CVSS_V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

joblib v1.4.2 was discovered to contain a deserialization vulnerability via the component joblib.numpy_pickle::NumpyArrayWrapper().read_array(). NOTE: this is disputed by the supplier because NumpyArrayWrapper is only used during caching of trusted content.

Affected packages

Package	Versions
PyPI · joblib	introduced 0, last affected 1.4.2

References

https://github.com/joblib/joblib/issues/1582 REPORT
https://github.com/joblib/joblib/issues/977 REPORT

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — PyPA Advisory Database