PYSEC-2022-95

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/tensorflow-cpu/PYSEC-2022-95.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2022-95
Aliases
Published
2022-02-04T23:15:00Z
Modified
2023-12-06T01:02:01.286738Z
Summary
[none]
Details

Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a SavedModel such that assertions in function.cc would be falsified and crash the Python interpreter. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

References

Affected packages

PyPI / tensorflow-cpu

Package

Name
tensorflow-cpu
View open source insights on deps.dev
Purl
pkg:pypi/tensorflow-cpu

Affected ranges

Type
GIT
Repo
https://github.com/tensorflow/tensorflow
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3d89911481ba6ebe8c88c1c0b595412121e6c645
Fixed
dcc21c7bc972b10b6fb95c2fb0f4ab5a59680ec2
Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.5.3
Introduced
2.6.0
Fixed
2.6.3

Affected versions

1.*

1.15.0

2.*

2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.2.0
2.2.1
2.2.2
2.2.3
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2