VDB
Sign up
—

PYSEC-2021-215

Quick fix

PYSEC-2021-215 — tensorflow: upgrade to the fixed version with the command below.

pip install --upgrade 'tensorflow>=12c727cee857fa19be717f336943d95fca4ffe4f'

Details

TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.FractionalAvgPoolGrad` is vulnerable to a heap buffer overflow. The implementation(https://github.com/tensorflow/tensorflow/blob/dcba796a28364d6d7f003f6fe733d82726dda713/tensorflow/core/kernels/fractional_avg_pool_op.cc#L216) fails to validate that the pooling sequence arguments have enough elements as required by the `out_backprop` tensor shape. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/tensorflow
Introduced in: 0Fixed in: 12c727cee857fa19be717f336943d95fca4ffe4f
Fixpip install --upgrade 'tensorflow>=12c727cee857fa19be717f336943d95fca4ffe4f'

References