QID 981507
QID 981507: Python (pip) Security Update for tensorflow-gpu (GHSA-hwr7-8gxx-fj5p)
Security update has been released for tensorflow-gpu,tensorflow,tensorflow-cpu to fix the vulnerability.
Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.
Sending invalid argument for `row_partition_types` of `tf.raw_ops.RaggedTensorToTensor` API results in a null pointer dereference and undefined behavior:
```python
import tensorflow as tf
tf.raw_ops.RaggedTensorToTensor(
shape=1,
values=10,
default_value=21,
row_partition_tensors=tf.constant([0,0,0,0]),
row_partition_types=[])
```
The [implementation](https://github.com/tensorflow/tensorflow/blob/47a06f40411a69c99f381495f490536972152ac0/tensorflow/core/kernels/ragged_tensor_to_tensor_op.cc#L328) accesses the first element of a user supplied list of values without validating that the provided list is not empty.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
- GHSA-hwr7-8gxx-fj5p -
github.com/advisories/GHSA-hwr7-8gxx-fj5p
CVEs related to QID 981507
| Advisory ID | Software | Component | Link |
|---|---|---|---|
| GHSA-hwr7-8gxx-fj5p | tensorflow |
|
|
| GHSA-hwr7-8gxx-fj5p | tensorflow-cpu |
|
|
| GHSA-hwr7-8gxx-fj5p | tensorflow-gpu |
|