QID 981470
QID 981470: Python (pip) Security Update for tensorflow-gpu (GHSA-qc53-44cj-vfvx)
Security update has been released for tensorflow-gpu,tensorflow,tensorflow-cpu to fix the vulnerability.
Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.
The `SparseCountSparseOutput` implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the `indices` tensor has rank 2. This tensor must be a matrix because code assumes its elements are accessed as elements of a matrix:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/count_ops.cc#L185
However, malicious users can pass in tensors of different rank, resulting in a `CHECK` assertion failure and a crash. This can be used to cause denial of service in serving installations, if users are allowed to control the components of the input sparse tensor.
We recommend users to upgrade to TensorFlow 2.3.1.
- GHSA-qc53-44cj-vfvx -
github.com/advisories/GHSA-qc53-44cj-vfvx
CVEs related to QID 981470
| Advisory ID | Software | Component | Link |
|---|---|---|---|
| GHSA-qc53-44cj-vfvx | tensorflow |
|
|
| GHSA-qc53-44cj-vfvx | tensorflow-cpu |
|
|
| GHSA-qc53-44cj-vfvx | tensorflow-gpu |
|