PyPI/tensorflow CVE-2020-26269: critical 9.1, EPSS 0.70%

TensorFlow vulnerable to heap out of bounds read in filesystem glob matching

Action: Upgrade tensorflow to 2.4.0 or later.

pip install tensorflow==2.4.0

Affected

Fixed versions

Sources

• osv: GHSA-9jjw-hf72-3mxw
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9jjw-hf72-3mxw
• https://nvd.nist.gov/vuln/detail/CVE-2020-26269
• https://github.com/tensorflow/tensorflow/pull/40861
• https://github.com/tensorflow/tensorflow/pull/44310
• https://github.com/tensorflow/tensorflow/commit/8b5b9dc96666a3a5d27fad7179ff215e3b74b67c
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2020-300.yaml
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2020-335.yaml
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2020-141.yaml
• https://github.com/tensorflow/tensorflow
• https://github.com/tensorflow/tensorflow/blob/458c6260265c46ebaf18052d6c61aea4b6b40926/tensorflow/core/platform/file_system_helper.cc#L106
• https://github.com/tensorflow/tensorflow/blob/458c6260265c46ebaf18052d6c61aea4b6b40926/tensorflow/core/platform/file_system_helper.cc#L127

CVE-2020-26269 · published 2022-10-07T07:22:33Z · modified 2026-09-10T03:49:46.420066944Z · JSON