QID 981544
QID 981544: Python (pip) Security Update for tensorflow-gpu (GHSA-9c8h-2mv3-49ww)
Security update has been released for tensorflow-gpu,tensorflow,tensorflow-cpu to fix the vulnerability.
Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.
Most implementations of convolution operators in TensorFlow are affected by a division by 0 vulnerability where an attacker can trigger a denial of service via a crash:
```python
import tensorflow as tf
tf.compat.v1.disable_v2_behavior()
tf.raw_ops.Conv2D(
input = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.float32),
filter = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.float32),
strides = [1, 1, 1, 1],
padding = "SAME")
```
The shape inference [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/framework/common_shape_fns.cc#L577) is missing several validations before doing divisions and modulo operations.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
- GHSA-9c8h-2mv3-49ww -
github.com/advisories/GHSA-9c8h-2mv3-49ww
CVEs related to QID 981544
| Advisory ID | Software | Component | Link |
|---|---|---|---|
| GHSA-9c8h-2mv3-49ww | tensorflow |
|
|
| GHSA-9c8h-2mv3-49ww | tensorflow-cpu |
|
|
| GHSA-9c8h-2mv3-49ww | tensorflow-gpu |
|