PyPI/tensorflow CVE-2018-21233: medium 6.5, EPSS 0.58%

Out-of-bounds read in TensorFlow possibly causing disclosure of the contents of process memory.

Action: Upgrade tensorflow to 1.7.0 or later.

pip install tensorflow==1.7.0

Affected

Fixed versions

Sources

• osv: GHSA-h98h-8mxr-m8gx
• https://nvd.nist.gov/vuln/detail/CVE-2018-21233
• https://github.com/tensorflow/tensorflow/commit/49f73c55d56edffebde4bca4a407ad69c1cae433
• https://github.com/advisories/GHSA-h98h-8mxr-m8gx
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2020-269.yaml
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2020-304.yaml
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2020-253.yaml
• https://github.com/tensorflow/tensorflow
• https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2018-001.md

CVE-2018-21233 · published 2020-05-13T16:01:35Z · modified 2024-10-28T14:44:19.394947Z · JSON