PYSEC-2020-307
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/tensorflow-gpu/PYSEC-2020-307.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2020-307
- Aliases
- Published
- 2020-09-25T19:15:00Z
- Modified
- 2023-12-06T00:45:15.241112Z
- Summary
- [none]
- Details
-
In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes a list of strings to
dlpack.to_dlpackthere is a memory leak following an expected validation failure. The issue occurs because thestatusargument during validation failures is not properly checked. Since each of the above methods can return an error status, thestatusvalue must be checked before continuing. The issue is patched in commit 22e07fb204386768e5bcbea563641ea11f96ceb8 and is released in TensorFlow versions 2.2.1, or 2.3.1. - References
-
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-8fxw-76px-3rxv
- https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1
- https://github.com/tensorflow/tensorflow/commit/22e07fb204386768e5bcbea563641ea11f96ceb8
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.html
Affected packages
PyPI / tensorflow-gpu
Package
- Name
- tensorflow-gpu
- View open source insights on deps.dev
- Purl
- pkg:pypi/tensorflow-gpu
Affected ranges
- Type
- GIT
- Repo
- https://github.com/tensorflow/tensorflow
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.2.1Introduced2.3.0rc0Fixed2.3.1
Affected versions
0.*
0.12.0
0.12.1
1.*
1.0.0
1.0.1
1.1.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.6.0
1.7.0
1.7.1
1.8.0
1.9.0
1.10.0
1.10.1
1.11.0
1.12.0
1.12.2
1.12.3
1.13.1
1.13.2
1.14.0
1.15.0
1.15.2
1.15.3
1.15.4
1.15.5
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.2.0
2.3.0