Vulnerability · Published May 14, 2021 · Assigned by GitHub_M
CVE-2021-29618Crash in `tf.transpose` with complex inputs
Low 2.5
In plain English
A low-severity security flaw in tensorflow from tensorflow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
TensorFlow is an end-to-end open source platform for machine learning. Passing a complex argument to `tf.transpose` at the same time as passing `conjugate=True` argument results in a crash. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | tensorflow | 2.3.3 | GHSA-xqfj-cr6q-pc8w |
| PyPI | tensorflow | 2.4.2 | GHSA-xqfj-cr6q-pc8w |
| PyPI | tensorflow | 2.1.4 | GHSA-xqfj-cr6q-pc8w |
| PyPI | tensorflow | 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3 | PYSEC-2021-255 |
| PyPI | tensorflow | 2.2.3 | GHSA-xqfj-cr6q-pc8w |
| PyPI | tensorflow-cpu | 2.4.2 | GHSA-xqfj-cr6q-pc8w |
| PyPI | tensorflow-cpu | 2.1.4 | GHSA-xqfj-cr6q-pc8w |
| PyPI | tensorflow-cpu | 2.2.3 | GHSA-xqfj-cr6q-pc8w |
| PyPI | tensorflow-cpu | 2.3.3 | GHSA-xqfj-cr6q-pc8w |
| PyPI | tensorflow-cpu | 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3 | PYSEC-2021-546 |
| PyPI | tensorflow-gpu | 2.3.3 | GHSA-xqfj-cr6q-pc8w |
| PyPI | tensorflow-gpu | 2.4.2 | GHSA-xqfj-cr6q-pc8w |
| PyPI | tensorflow-gpu | 2.1.4 | GHSA-xqfj-cr6q-pc8w |
| PyPI | tensorflow-gpu | 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3 | PYSEC-2021-744 |
| PyPI | tensorflow-gpu | 2.2.3 | GHSA-xqfj-cr6q-pc8w |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| tensorflow | tensorflow | < 2.1.4>= 2.2.0, < 2.2.3>= 2.3.0, < 2.3.3>= 2.4.0, < 2.4.2 |
Weakness: CWE-755 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
References
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xqfj-cr6q-pc8w x_refsource_CONFIRM
- https://github.com/tensorflow/tensorflow/commit/1dc6a7ce6e0b3e27a7ae650bfc05b195ca793f88 x_refsource_MISC
- https://github.com/tensorflow/issues/42105 x_refsource_MISC
- https://github.com/tensorflow/issues/46973 x_refsource_MISC