BIT-tensorflow-2021-41216

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/tensorflow/BIT-tensorflow-2021-41216.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-tensorflow-2021-41216

Aliases

Published

2024-03-06T11:16:10.594Z

Modified

2024-11-27T19:40:48.342Z

Summary

[none]

Details

TensorFlow is an open source platform for machine learning. In affected versions the shape inference function for Transpose is vulnerable to a heap buffer overflow. This occurs whenever perm contains negative elements. The shape inference function does not validate that the indices in perm are all valid. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

Database specific

{
    "cpes": [
        "cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:google:tensorflow:2.7.0:rc0:*:*:*:*:*:*",
        "cpe:2.3:a:google:tensorflow:2.7.0:rc1:*:*:*:*:*:*"
    ],
    "severity": "Medium"
}

References

Affected packages

Bitnami / tensorflow

Package

Name: tensorflow
Purl: pkg:bitnami/tensorflow

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

2.4.0

Fixed

2.4.4

Introduced

2.5.0

Fixed

2.5.2

Introduced

2.6.0

Fixed

2.6.1

Type: SEMVER
Events: Introduced

2.7.0-rc0

Last affected

2.7.0-rc0

Introduced

2.7.0-rc1

Last affected

2.7.0-rc1