Out-of-Bounds Affecting tensorflow package, versions [2.5.0,2.5.1)[2.4.0,2.4.3)[,2.3.4)


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.04% (15th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-PYTHON-TENSORFLOW-1540702
  • published13 Aug 2021
  • disclosed13 Aug 2021
  • creditUnknown

Introduced: 13 Aug 2021

CVE-2021-37672  (opens in a new tab)
CWE-125  (opens in a new tab)

How to fix?

Upgrade tensorflow to version 2.5.1, 2.4.3, 2.3.4 or higher.

Overview

tensorflow is a machine learning framework.

Affected versions of this package are vulnerable to Out-of-Bounds. An attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to tf.raw_ops.SdcaOptimizerV2. The implementation does not check that the length of example_labels is the same as the number of examples.

References

CVSS Scores

version 3.1