BIT-tensorflow-2021-41225

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/tensorflow/BIT-tensorflow-2021-41225.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-tensorflow-2021-41225
Aliases
Published
2024-03-06T11:15:58.880Z
Modified
2024-11-27T19:40:48.342Z
Summary
[none]
Details

TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's Grappler optimizer has a use of unitialized variable. If the train_nodes vector (obtained from the saved model that gets optimized) does not contain a Dequeue node, then dequeue_node is left unitialized. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

Database specific
{
    "cpes": [
        "cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:google:tensorflow:2.7.0:rc0:*:*:*:*:*:*",
        "cpe:2.3:a:google:tensorflow:2.7.0:rc1:*:*:*:*:*:*"
    ],
    "severity": "Medium"
}
References

Affected packages

Bitnami / tensorflow

Package

Name
tensorflow
Purl
pkg:bitnami/tensorflow

Severity

  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
2.4.0
Fixed
2.4.4
Introduced
2.5.0
Fixed
2.5.2
Introduced
2.6.0
Fixed
2.6.1
Type
SEMVER
Events
Introduced
2.7.0-rc0
Last affected
2.7.0-rc0
Introduced
2.7.0-rc1
Last affected
2.7.0-rc1