tocsin

PyPI/tensorflow CVE-2020-26267: unknown, EPSS 0.24%

In affected versions of TensorFlow the tf.raw_ops.DataFormatVecPermute API does not validate the src_format and dst_format attributes. The code assumes that these two arguments define a permutation of

Action: Upgrade tensorflow to 1.15.5 or later.

pip install tensorflow==1.15.5
pip install tensorflow==2.0.4
pip install tensorflow==2.1.3
pip install tensorflow==2.2.2
pip install tensorflow==2.3.2

Affected

introducedfixedlast affected
01.15.5-
2.0.02.0.4-
2.1.02.1.3-
2.2.02.2.2-
2.3.02.3.2-

Fixed versions

1.15.52.0.42.1.32.2.22.3.2

Sources

CVE-2020-26267 · published · modified · JSON