BIT-tensorflow-2020-15198

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/tensorflow/BIT-tensorflow-2020-15198.json
JSON Data
https://api.test.osv.dev/v1/vulns/BIT-tensorflow-2020-15198
Aliases
Published
2024-03-06T11:20:42.418Z
Modified
2024-03-06T11:25:28.861Z
Summary
[none]
Details

In Tensorflow before version 2.3.1, the SparseCountSparseOutput implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the indices tensor has the same shape as the values one. The values in these tensors are always accessed in parallel. Thus, a shape mismatch can result in accesses outside the bounds of heap allocated buffers. The issue is patched in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and is released in TensorFlow version 2.3.1.

Database specific 
{
    "cpes": [
        "cpe:2.3:a:google:tensorflow:*:*:*:*:-:*:*:*"
    ],
    "severity": "Medium"
}
References

Affected packages

Bitnami / tensorflow

Package

Name
tensorflow
Purl
pkg:bitnami/tensorflow

Severity

  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
2.3.0
Fixed
2.3.1