CVE-2021-41212

Опубликовано: 05 нояб. 2021

Источник: nvd

CVSS3: 7.1

CVSS2: 3.6

EPSS Низкий

Описание

TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for tf.ragged.cross can trigger a read outside of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

Ссылки

https://github.com/tensorflow/tensorflow/commit/fa6b7782fbb14aa08d767bc799c531f5e1fb3bb8
Patch
Third Party Advisory
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-fr77-rrx3-cp7g
Exploit
Patch
Third Party Advisory
https://github.com/tensorflow/tensorflow/commit/fa6b7782fbb14aa08d767bc799c531f5e1fb3bb8
Patch
Third Party Advisory
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-fr77-rrx3-cp7g
Exploit
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*

Версия до 2.4.4 (исключая)

cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*

Версия от 2.5.0 (включая) до 2.5.2 (исключая)

cpe:2.3:a:google:tensorflow:2.6.0:*:*:*:*:*:*:*

EPSS

Процентиль: 4%

0.00019

Низкий

7.1 High

CVSS3

3.6 Low

CVSS2

Дефекты

CWE-125

Связанные уязвимости

CVE-2021-41212

CVSS3: 7.1

debian

больше 4 лет назад

TensorFlow is an open source platform for machine learning. In affecte ...

GHSA-fr77-rrx3-cp7g

CVSS3: 7.1

github

около 4 лет назад

Heap OOB read in `tf.ragged.cross`

EPSS

Процентиль: 4%

0.00019

Низкий

7.1 High

CVSS3

3.6 Low

CVSS2

Дефекты

CWE-125