QID 980175
QID 980175: Python (pip) Security Update for tensorflow-gpu (GHSA-m342-ff57-4jcc)
Security update has been released for tensorflow-gpu,tensorflow,tensorflow-cpu to fix the vulnerability.
Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.
The [shape inference functions for `SparseCountSparseOutput`](https://github.com/tensorflow/tensorflow/blob/e0b6e58c328059829c3eb968136f17aa72b6c876/tensorflow/core/ops/count_ops.cc#L43-L50) can trigger a read outside of bounds of heap allocated array:
```python
import tensorflow as tf
@tf.function
def func():
return tf.raw_ops.SparseCountSparseOutput(
indices=[1],
values=[[1]],
dense_shape=[10],
weights=[],
binary_output= True)
func()
```
The function fails to check that the first input (i.e., `indices`) has rank 2:
```cc
auto rank = c->Dim(c->input(0), 1);
```
The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- GHSA-m342-ff57-4jcc -
github.com/advisories/GHSA-m342-ff57-4jcc
CVEs related to QID 980175
| Advisory ID | Software | Component | Link |
|---|---|---|---|
| GHSA-m342-ff57-4jcc | tensorflow |
|
|
| GHSA-m342-ff57-4jcc | tensorflow-cpu |
|
|
| GHSA-m342-ff57-4jcc | tensorflow-gpu |
|