BIT-tensorflow-2021-41222

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/tensorflow/BIT-tensorflow-2021-41222.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-tensorflow-2021-41222

Aliases

Published

2024-03-06T11:16:02.723Z

Modified

2024-03-06T11:25:28.861Z

Summary

[none]

Details

TensorFlow is an open source platform for machine learning. In affected versions the implementation of SplitV can trigger a segfault is an attacker supplies negative arguments. This occurs whenever size_splits contains more than one value and at least one value is negative. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

Database specific

{
    "cpes": [
        "cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:google:tensorflow:2.7.0:rc0:*:*:*:*:*:*",
        "cpe:2.3:a:google:tensorflow:2.7.0:rc1:*:*:*:*:*:*"
    ],
    "severity": "Medium"
}

References

Affected packages

Bitnami / tensorflow

Package

Name: tensorflow
Purl: pkg:bitnami/tensorflow

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

2.4.0

Fixed

2.4.4

Introduced

2.5.0

Fixed

2.5.2

Introduced

2.6.0

Fixed

2.6.1

Type: SEMVER
Events: Introduced

2.7.0-rc0

Last affected

2.7.0-rc0

Introduced

2.7.0-rc1

Last affected

2.7.0-rc1