BIT-tensorflow-2022-41893

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/tensorflow/BIT-tensorflow-2022-41893.json

JSON Data

https://api.test.osv.dev/v1/vulns/BIT-tensorflow-2022-41893

Aliases

Published

2024-03-06T11:11:03.808Z

Modified

2025-05-20T10:02:07.006Z

Summary

`CHECK_EQ` fail in `tf.raw_ops.TensorListResize` in Tensorflow

Details

TensorFlow is an open source platform for machine learning. If tf.raw_ops.TensorListResize is given a nonscalar value for input size, it results CHECK fail which can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 888e34b49009a4e734c27ab0c43b0b5102682c56. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

Database specific

{
    "cpes": [
        "cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
}

References

Affected packages

Bitnami / tensorflow

Package

Name: tensorflow
Purl: pkg:bitnami/tensorflow

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.8.4

Introduced

2.9.0

Fixed

2.9.3

Introduced

2.10.0

Fixed

2.10.1

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/tensorflow/BIT-tensorflow-2022-41893.json"