PYSEC-2021-215
Quick fix
PYSEC-2021-215 — tensorflow: upgrade to the fixed version with the command below.
pip install --upgrade 'tensorflow>=12c727cee857fa19be717f336943d95fca4ffe4f'Details
TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.FractionalAvgPoolGrad` is vulnerable to a heap buffer overflow. The implementation(https://github.com/tensorflow/tensorflow/blob/dcba796a28364d6d7f003f6fe733d82726dda713/tensorflow/core/kernels/fractional_avg_pool_op.cc#L216) fails to validate that the pooling sequence arguments have enough elements as required by the `out_backprop` tensor shape. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Are you affected?
Enter the version of the package you're using.
Affected packages
0Fixed in: 12c727cee857fa19be717f336943d95fca4ffe4fpip install --upgrade 'tensorflow>=12c727cee857fa19be717f336943d95fca4ffe4f'