CVE-2021-29618

TensorFlow is an end-to-end open source platform for machine learning. Passing a complex argument to `tf.transpose` at the same time as passing `conjugate=True` argument results in a crash. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
GitHub_MCNA
2.5 LOW
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 5%
Affected Products (NVD)
VendorProductVersion
googletensorflow
𝑥
< 2.1.4
googletensorflow
2.2.0 ≤
𝑥
< 2.2.3
googletensorflow
2.3.0 ≤
𝑥
< 2.3.3
googletensorflow
2.4.0 ≤
𝑥
< 2.4.2
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
tensorflowtensorflow
𝑥
< 2.1.4
CNA
Common Weakness Enumeration
References
https://github.com/tensorflow/issues/42105
https://github.com/tensorflow/issues/46973
https://github.com/tensorflow/tensorflow/commit/1dc6a7ce6e0b3e27a7ae650bfc05b195ca793f88
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xqfj-cr6q-pc8w
https://github.com/tensorflow/issues/42105
https://github.com/tensorflow/issues/46973
https://github.com/tensorflow/tensorflow/commit/1dc6a7ce6e0b3e27a7ae650bfc05b195ca793f88
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xqfj-cr6q-pc8w