—

PYSEC-2021-250

Quick fix

PYSEC-2021-250 — tensorflow: upgrade to the fixed version with the command below.

pip install --upgrade 'tensorflow>=14607c0707040d775e06b6817325640cb4b5864c'

Details

TensorFlow is an end-to-end open source platform for machine learning. Incomplete validation in `tf.raw_ops.CTCLoss` allows an attacker to trigger an OOB read from heap. The fix will be included in TensorFlow 2.5.0. We will also cherrypick these commits on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/tensorflow

Introduced in: 0Fixed in: 14607c0707040d775e06b6817325640cb4b5864c

Fixpip install --upgrade 'tensorflow>=14607c0707040d775e06b6817325640cb4b5864c'

References

https://github.com/tensorflow/tensorflow/security/advisories/GHSA-vvg4-vgrv-xfr7[ADVISORY]
https://github.com/tensorflow/tensorflow/commit/14607c0707040d775e06b6817325640cb4b5864c[FIX]
https://github.com/tensorflow/tensorflow/commit/4504a081af71514bb1828048363e6540f797005b[FIX]