import numpy-1.14.2-13.module+el8.1.0+3323+7ac3e00f

.gitignore

+SOURCES/numpy-1.14.2.tar.gz
+SOURCES/numpy-html-1.13.0.zip

.numpy.metadata

+c00e70468703830a26ee9173ba1cf4aedf08718f SOURCES/numpy-1.14.2.tar.gz
+b23d66880bba5f56baa81ce02eb5a55de046c0a7 SOURCES/numpy-html-1.13.0.zip

SOURCES/numpy-1.14.2-CVE-2019-6446.patch

+From 0fcfa065d900040c80628b31b8b6ea606c131086 Mon Sep 17 00:00:00 2001
+From: Paul Ivanov <pivanov5@bloomberg.net>
+Date: Wed, 30 Jan 2019 14:22:44 -0800
+Subject: [PATCH] BUG: load fails when using pickle without allow_pickle=True
+
+a partial mitigation of #12759.
+
+see also https://nvd.nist.gov/vuln/detail/CVE-2019-6446
+---
+ numpy/core/tests/test_regression.py |  2 +-
+ numpy/lib/format.py                 |  8 ++++++--
+ numpy/lib/npyio.py                  | 17 ++++++++++++-----
+ numpy/lib/tests/test_format.py      | 15 +++++++++------
+ numpy/lib/tests/test_io.py          |  2 +-
+ 5 files changed, 29 insertions(+), 15 deletions(-)
+
+diff --git a/numpy/core/tests/test_regression.py b/numpy/core/tests/test_regression.py
+index a3b0114..2be6bf3 100644
+--- a/numpy/core/tests/test_regression.py
++++ b/numpy/core/tests/test_regression.py
+@@ -96,7 +96,7 @@ class TestRegression(object):
+         ca = np.char.array(np.arange(1000, 1010), itemsize=4)
+         ca.dump(f)
+         f.seek(0)
+-        ca = np.load(f)
++        ca = np.load(f, allow_pickle=True)
+         f.close()
+ 
+     def test_noncontiguous_fill(self):
+diff --git a/numpy/lib/format.py b/numpy/lib/format.py
+index 363bb21..b91142c 100644
+--- a/numpy/lib/format.py
++++ b/numpy/lib/format.py
+@@ -602,7 +602,7 @@ def write_array(fp, array, version=None, allow_pickle=True, pickle_kwargs=None):
+                 fp.write(chunk.tobytes('C'))
+ 
+ 
+-def read_array(fp, allow_pickle=True, pickle_kwargs=None):
++def read_array(fp, allow_pickle=False, pickle_kwargs=None):
+     """
+     Read an array from an NPY file.
+ 
+@@ -612,7 +612,11 @@ def read_array(fp, allow_pickle=True, pickle_kwargs=None):
+         If this is not a real file object, then this may take extra memory
+         and time.
+     allow_pickle : bool, optional
+-        Whether to allow reading pickled data. Default: True
++        Whether to allow writing pickled data. Default: False
++
++        .. versionchanged:: 1.14.2
++            Made default False in response to CVE-2019-6446.
++
+     pickle_kwargs : dict
+         Additional keyword arguments to pass to pickle.load. These are only
+         useful when loading object arrays saved on Python 2 when using
+diff --git a/numpy/lib/npyio.py b/numpy/lib/npyio.py
+index 76b135c..c6522f5 100644
+--- a/numpy/lib/npyio.py
++++ b/numpy/lib/npyio.py
+@@ -130,7 +130,11 @@ class NpzFile(object):
+         An object on which attribute can be performed as an alternative
+         to getitem access on the `NpzFile` instance itself.
+     allow_pickle : bool, optional
+-        Allow loading pickled data. Default: True
++        Allow loading pickled data. Default: False
++
++        .. versionchanged:: 1.14.2
++            Made default False in response to CVE-2019-6446.
++
+     pickle_kwargs : dict, optional
+         Additional keyword arguments to pass on to pickle.load.
+         These are only useful when loading object arrays saved on
+@@ -166,7 +170,7 @@ class NpzFile(object):
+ 
+     """
+ 
+-    def __init__(self, fid, own_fid=False, allow_pickle=True,
++    def __init__(self, fid, own_fid=False, allow_pickle=False,
+                  pickle_kwargs=None):
+         # Import is postponed to here since zipfile depends on gzip, an
+         # optional component of the so-called standard library.
+@@ -265,7 +269,7 @@ class NpzFile(object):
+         return self.files.__contains__(key)
+ 
+ 
+-def load(file, mmap_mode=None, allow_pickle=True, fix_imports=True,
++def load(file, mmap_mode=None, allow_pickle=False, fix_imports=True,
+          encoding='ASCII'):
+     """
+     Load arrays or pickled objects from ``.npy``, ``.npz`` or pickled files.
+@@ -287,8 +291,11 @@ def load(file, mmap_mode=None, allow_pickle=True, fix_imports=True,
+         Allow loading pickled object arrays stored in npy files. Reasons for
+         disallowing pickles include security, as loading pickled data can
+         execute arbitrary code. If pickles are disallowed, loading object
+-        arrays will fail.
+-        Default: True
++        arrays will fail. Default: False
++
++        .. versionchanged:: 1.14.2
++            Made default False in response to CVE-2019-6446.
++
+     fix_imports : bool, optional
+         Only useful when loading Python 2 generated pickled files on Python 3,
+         which includes npy/npz files containing object arrays. If `fix_imports`
+diff --git a/numpy/lib/tests/test_format.py b/numpy/lib/tests/test_format.py
+index 2d2b4ce..04e090c 100644
+--- a/numpy/lib/tests/test_format.py
++++ b/numpy/lib/tests/test_format.py
+@@ -426,7 +426,7 @@ def roundtrip(arr):
+     f = BytesIO()
+     format.write_array(f, arr)
+     f2 = BytesIO(f.getvalue())
+-    arr2 = format.read_array(f2)
++    arr2 = format.read_array(f2, allow_pickle=True)
+     return arr2
+ 
+ 
+@@ -553,7 +553,7 @@ def test_pickle_python2_python3():
+         path = os.path.join(data_dir, fname)
+ 
+         for encoding in ['bytes', 'latin1']:
+-            data_f = np.load(path, encoding=encoding)
++            data_f = np.load(path, allow_pickle=True, encoding=encoding)
+             if fname.endswith('.npz'):
+                 data = data_f['x']
+                 data_f.close()
+@@ -575,16 +575,19 @@ def test_pickle_python2_python3():
+         if sys.version_info[0] >= 3:
+             if fname.startswith('py2'):
+                 if fname.endswith('.npz'):
+-                    data = np.load(path)
++                    data = np.load(path, allow_pickle=True)
+                     assert_raises(UnicodeError, data.__getitem__, 'x')
+                     data.close()
+-                    data = np.load(path, fix_imports=False, encoding='latin1')
++                    data = np.load(path, allow_pickle=True, fix_imports=False,
++                                   encoding='latin1')
+                     assert_raises(ImportError, data.__getitem__, 'x')
+                     data.close()
+                 else:
+-                    assert_raises(UnicodeError, np.load, path)
++                    assert_raises(UnicodeError, np.load, path,
++                                  allow_pickle=True)
+                     assert_raises(ImportError, np.load, path,
+-                                  encoding='latin1', fix_imports=False)
++                                  allow_pickle=True, fix_imports=False,
++                                  encoding='latin1')
+ 
+ 
+ def test_pickle_disallow():
+diff --git a/numpy/lib/tests/test_io.py b/numpy/lib/tests/test_io.py
+index 2daa015..bde2567 100644
+--- a/numpy/lib/tests/test_io.py
++++ b/numpy/lib/tests/test_io.py
+@@ -87,7 +87,7 @@ class RoundtripTest(object):
+ 
+         """
+         save_kwds = kwargs.get('save_kwds', {})
+-        load_kwds = kwargs.get('load_kwds', {})
++        load_kwds = kwargs.get('load_kwds', {"allow_pickle": True})
+         file_on_disk = kwargs.get('file_on_disk', False)
+ 
+         if file_on_disk:
+-- 
+2.21.0
+