BIT-tensorflow-2020-15203
See a problem?- Import Source
- https://github.com/bitnami/vulndb/tree/main/data/tensorflow/BIT-tensorflow-2020-15203.json
- JSON Data
- https://api.osv.dev/v1/vulns/BIT-tensorflow-2020-15203
- Aliases
- Published
- 2024-03-06T11:20:36.172Z
- Modified
- 2024-03-06T11:25:28.861Z
- Summary
- [none]
- Details
-
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the
fillargument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in aprintfcall is constructed. This may result in segmentation fault. The issue is patched in commit 33be22c65d86256e6826666662e40dbdfe70ee83, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1. - Database specific
{ "cpes": [ "cpe:2.3:a:google:tensorflow:*:*:*:*:-:*:*:*" ], "severity": "High" }- References
-
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.html
- https://github.com/tensorflow/tensorflow/commit/33be22c65d86256e6826666662e40dbdfe70ee83
- https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xmq7-7fxm-rr79
Affected packages
Bitnami / tensorflow
Package
- Name
- tensorflow
- Purl
- pkg:bitnami/tensorflow
Severity
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator