GHSA-qw5h-7f53-xrp6
Suggest an improvement- Source
- https://github.com/advisories/GHSA-qw5h-7f53-xrp6
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-qw5h-7f53-xrp6/GHSA-qw5h-7f53-xrp6.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-qw5h-7f53-xrp6
- Aliases
- Related
- Published
- 2021-05-21T14:28:45Z
- Modified
- 2024-11-13T16:52:27.368191Z
- Severity
-
- 2.5 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
- 2.0 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Stack overflow in `ParseAttrValue` with nested tensors
- Details
-
Impact
The implementation of
ParseAttrValuecan be tricked into stack overflow due to recursion by giving in a specially crafted input.Patches
We have patched the issue in GitHub commit e07e1c3d26492c06f078c7e5bf2d138043e199c1.
The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
- Database specific
{ "nvd_published_at": "2021-05-14T20:15:00Z", "cwe_ids": [ "CWE-674" ], "severity": "LOW", "github_reviewed": true, "github_reviewed_at": "2021-05-17T21:22:43Z" }- References
-
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-qw5h-7f53-xrp6
- https://nvd.nist.gov/vuln/detail/CVE-2021-29615
- https://github.com/tensorflow/tensorflow/commit/e07e1c3d26492c06f078c7e5bf2d138043e199c1
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-543.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-741.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-252.yaml
- https://github.com/tensorflow/tensorflow
Affected packages
PyPI / tensorflow
Package
- Name
- tensorflow
- View open source insights on deps.dev
- Purl
- pkg:pypi/tensorflow
PyPI / tensorflow
Package
- Name
- tensorflow
- View open source insights on deps.dev
- Purl
- pkg:pypi/tensorflow
PyPI / tensorflow
Package
- Name
- tensorflow
- View open source insights on deps.dev
- Purl
- pkg:pypi/tensorflow
PyPI / tensorflow
Package
- Name
- tensorflow
- View open source insights on deps.dev
- Purl
- pkg:pypi/tensorflow
PyPI / tensorflow-cpu
Package
- Name
- tensorflow-cpu
- View open source insights on deps.dev
- Purl
- pkg:pypi/tensorflow-cpu
PyPI / tensorflow-cpu
Package
- Name
- tensorflow-cpu
- View open source insights on deps.dev
- Purl
- pkg:pypi/tensorflow-cpu
PyPI / tensorflow-cpu
Package
- Name
- tensorflow-cpu
- View open source insights on deps.dev
- Purl
- pkg:pypi/tensorflow-cpu
PyPI / tensorflow-cpu
Package
- Name
- tensorflow-cpu
- View open source insights on deps.dev
- Purl
- pkg:pypi/tensorflow-cpu
PyPI / tensorflow-gpu
Package
- Name
- tensorflow-gpu
- View open source insights on deps.dev
- Purl
- pkg:pypi/tensorflow-gpu
PyPI / tensorflow-gpu
Package
- Name
- tensorflow-gpu
- View open source insights on deps.dev
- Purl
- pkg:pypi/tensorflow-gpu
PyPI / tensorflow-gpu
Package
- Name
- tensorflow-gpu
- View open source insights on deps.dev
- Purl
- pkg:pypi/tensorflow-gpu
PyPI / tensorflow-gpu
Package
- Name
- tensorflow-gpu
- View open source insights on deps.dev
- Purl
- pkg:pypi/tensorflow-gpu