PYSEC-2020-278

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/tensorflow-cpu/PYSEC-2020-278.yaml
JSON Data
https://api.test.osv.dev/v1/vulns/PYSEC-2020-278
Aliases
Published
2020-09-25T19:15:00Z
Modified
2023-12-06T00:45:15.604193Z
Summary
[none]
Details

In Tensorflow before version 2.3.1, the SparseCountSparseOutput implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the indices tensor has the same shape as the values one. The values in these tensors are always accessed in parallel. Thus, a shape mismatch can result in accesses outside the bounds of heap allocated buffers. The issue is patched in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and is released in TensorFlow version 2.3.1.

References

Affected packages

PyPI / tensorflow-cpu

Package

Name
tensorflow-cpu
View open source insights on deps.dev
Purl
pkg:pypi/tensorflow-cpu

Affected ranges

Type
GIT
Repo
https://github.com/tensorflow/tensorflow
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3cbb917b4714766030b28eba9fb41bb97ce9ee02
Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.3.1

Affected versions

1.*

1.15.0

2.*

2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.2.0
2.2.1
2.2.2
2.2.3
2.3.0