CVE-2021-41210

Опубликовано: 05 нояб. 2021

Источник: nvd

CVSS3: 7.1

CVSS2: 3.6

EPSS Низкий

Описание

TensorFlow is an open source platform for machine learning. In affected versions the shape inference functions for SparseCountSparseOutput can trigger a read outside of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

Ссылки

https://github.com/tensorflow/tensorflow/commit/701cfaca222a82afbeeb17496bd718baa65a67d2
Patch
Third Party Advisory
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-m342-ff57-4jcc
Third Party Advisory
https://github.com/tensorflow/tensorflow/commit/701cfaca222a82afbeeb17496bd718baa65a67d2
Patch
Third Party Advisory
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-m342-ff57-4jcc
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*

Версия до 2.4.4 (исключая)

cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*

Версия от 2.5.0 (включая) до 2.5.2 (исключая)

cpe:2.3:a:google:tensorflow:2.6.0:*:*:*:*:*:*:*

EPSS

Процентиль: 4%

0.00019

Низкий

7.1 High

CVSS3

3.6 Low

CVSS2

Дефекты

CWE-125

Связанные уязвимости

CVE-2021-41210

CVSS3: 7.1

debian

больше 4 лет назад

TensorFlow is an open source platform for machine learning. In affecte ...

GHSA-m342-ff57-4jcc

CVSS3: 7.1

github

около 4 лет назад

Heap OOB read in `tf.raw_ops.SparseCountSparseOutput`

EPSS

Процентиль: 4%

0.00019

Низкий

7.1 High

CVSS3

3.6 Low

CVSS2

Дефекты

CWE-125