QID 981471
QID 981471: Python (pip) Security Update for tensorflow-gpu (GHSA-x5cp-9pcf-pp3h)
Security update has been released for tensorflow-gpu,tensorflow,tensorflow-cpu to fix the vulnerability.
Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.
The `RaggedCountSparseOutput` does not validate that the input arguments form a valid ragged tensor. In particular, there is no validation that the `splits` tensor has the minimum required number of elements. Code uses this quantity to initialize a different data structure:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/count_ops.cc#L241-L244
Since `BatchedMap` is equivalent to a vector, it needs to have at least one element to not be `nullptr`. If user passes a `splits` tensor that is empty or has exactly one element, we get a `SIGABRT` signal raised by the operating system.
We recommend users to upgrade to TensorFlow 2.3.1.
- GHSA-x5cp-9pcf-pp3h -
github.com/advisories/GHSA-x5cp-9pcf-pp3h
CVEs related to QID 981471
| Advisory ID | Software | Component | Link |
|---|---|---|---|
| GHSA-x5cp-9pcf-pp3h | tensorflow |
|
|
| GHSA-x5cp-9pcf-pp3h | tensorflow-cpu |
|
|
| GHSA-x5cp-9pcf-pp3h | tensorflow-gpu |
|