PyPI/tensorflow-cpu CVE-2022-23560: unknown, EPSS 0.84%
Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would allow limited reads and writes outside of arrays in TFLite. This exploits missing validation in
Action: Upgrade tensorflow-cpu to 2.5.3 or later.
pip install tensorflow-cpu==2.5.3pip install tensorflow-cpu==2.6.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.5.3 | - |
| 2.6.0 | 2.6.3 | - |
Fixed versions
| 2.5.3 | 2.6.3 |
Sources
- osv: PYSEC-2022-69
- https://github.com/tensorflow/tensorflow/commit/6364463d6f5b6254cac3d6aedf999b6a96225038
- https://github.com/tensorflow/tensorflow/blob/ca6f96b62ad84207fbec580404eaa7dd7403a550/tensorflow/lite/kernels/internal/utils/sparsity_format_converter.cc#L252-L293
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-4hvf-hxvg-f67v
CVE-2022-23560 · published · modified · JSON