QID 980173
QID 980173: Python (pip) Security Update for tensorflow (GHSA-7v94-64hj-m82h)
Security update has been released for tensorflow to fix the vulnerability.
Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.
The [implementation of `ParallelConcat`](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/inplace_ops.cc#L72-L97) misses some input validation and can produce a division by 0:
```python
import tensorflow as tf
@tf.function
def test():
y = tf.raw_ops.ParallelConcat(values=[['tf']],shape=0)
return y
test()
```
Solution
We have patched the issue in GitHub commit [f2c3931113eaafe9ef558faaddd48e00a6606235](https://github.com/tensorflow/tensorflow/commit/f2c3931113eaafe9ef558faaddd48e00a6606235).
The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Vendor References
- GHSA-7v94-64hj-m82h -
github.com/advisories/GHSA-7v94-64hj-m82h
CVEs related to QID 980173
Software Advisories
| Advisory ID | Software | Component | Link |
|---|---|---|---|
| GHSA-7v94-64hj-m82h | tensorflow |
|