PYSEC-2020-123

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/tensorflow/PYSEC-2020-123.yaml
JSON Data
https://api.test.osv.dev/v1/vulns/PYSEC-2020-123
Aliases
Published
2020-09-25T19:15:00Z
Modified
2023-12-06T00:45:15.725514Z
Summary
[none]
Details

In Tensorflow before version 2.3.1, the RaggedCountSparseOutput implementation does not validate that the input arguments form a valid ragged tensor. In particular, there is no validation that the values in the splits tensor generate a valid partitioning of the values tensor. Thus, the code sets up conditions to cause a heap buffer overflow. A BatchedMap is equivalent to a vector where each element is a hashmap. However, if the first element of splits_values is not 0, batch_idx will never be 1, hence there will be no hashmap at index 0 in per_batch_counts. Trying to access that in the user code results in a segmentation fault. The issue is patched in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and is released in TensorFlow version 2.3.1.

References

Affected packages

PyPI / tensorflow

Package

Name
tensorflow
View open source insights on deps.dev
Purl
pkg:pypi/tensorflow

Affected ranges

Type
GIT
Repo
https://github.com/tensorflow/tensorflow
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3cbb917b4714766030b28eba9fb41bb97ce9ee02
Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.3.1

Affected versions

0.*

0.12.0rc0
0.12.0rc1
0.12.0
0.12.1

1.*

1.0.0
1.0.1
1.1.0rc0
1.1.0rc1
1.1.0rc2
1.1.0
1.2.0rc0
1.2.0rc1
1.2.0rc2
1.2.0
1.2.1
1.3.0rc0
1.3.0rc1
1.3.0rc2
1.3.0
1.4.0rc0
1.4.0rc1
1.4.0
1.4.1
1.5.0rc0
1.5.0rc1
1.5.0
1.5.1
1.6.0rc0
1.6.0rc1
1.6.0
1.7.0rc0
1.7.0rc1
1.7.0
1.7.1
1.8.0rc0
1.8.0rc1
1.8.0
1.9.0rc0
1.9.0rc1
1.9.0rc2
1.9.0
1.10.0rc0
1.10.0rc1
1.10.0
1.10.1
1.11.0rc0
1.11.0rc1
1.11.0rc2
1.11.0
1.12.0rc0
1.12.0rc1
1.12.0rc2
1.12.0
1.12.2
1.12.3
1.13.0rc0
1.13.0rc1
1.13.0rc2
1.13.1
1.13.2
1.14.0rc0
1.14.0rc1
1.14.0
1.15.0rc0
1.15.0rc1
1.15.0rc2
1.15.0rc3
1.15.0
1.15.2
1.15.3
1.15.4
1.15.5

2.*

2.0.0a0
2.0.0b0
2.0.0b1
2.0.0rc0
2.0.0rc1
2.0.0rc2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0rc0
2.1.0rc1
2.1.0rc2
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.2.0rc0
2.2.0rc1
2.2.0rc2
2.2.0rc3
2.2.0rc4
2.2.0
2.2.1
2.2.2
2.2.3
2.3.0rc0
2.3.0rc1
2.3.0rc2
2.3.0