QID 980053
QID 980053: Python (pip) Security Update for tensorflow-gpu (GHSA-p5f8-gfw5-33w4)
Security update has been released for tensorflow-gpu,tensorflow,tensorflow-cpu to fix the vulnerability.
Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.
The `RaggedCountSparseOutput` implementation does not validate that the input arguments form a valid ragged tensor. In particular, there is no validation that the values in the `splits` tensor generate a valid partitioning of the `values` tensor. Hence, this code is prone to heap buffer overflow:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/count_ops.cc#L248-L251
If `split_values` does not end with a value at least `num_values` then the `while` loop condition will trigger a read outside of the bounds of `split_values` once `batch_idx` grows too large.
We recommend users to upgrade to TensorFlow 2.3.1.
- GHSA-p5f8-gfw5-33w4 -
github.com/advisories/GHSA-p5f8-gfw5-33w4
CVEs related to QID 980053
| Advisory ID | Software | Component | Link |
|---|---|---|---|
| GHSA-p5f8-gfw5-33w4 | tensorflow |
|
|
| GHSA-p5f8-gfw5-33w4 | tensorflow-cpu |
|
|
| GHSA-p5f8-gfw5-33w4 | tensorflow-gpu |
|