CVE-2022-23560
6 advisories.
PyPI/tensorflow CVE-2022-23560: high 8.8, EPSS 0.84%
Read and Write outside of bounds in TensorFlow
Action: Upgrade tensorflow to 2.5.3 or later.
pip install tensorflow==2.5.3pip install tensorflow==2.6.3pip install tensorflow==2.7.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.5.3 | - |
| 2.6.0 | 2.6.3 | - |
| 2.7.0 | 2.7.1 | - |
Fixed versions
| 2.5.3 | 2.6.3 | 2.7.1 |
Sources
- osv: GHSA-4hvf-hxvg-f67v
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-4hvf-hxvg-f67v
- https://nvd.nist.gov/vuln/detail/CVE-2022-23560
- https://github.com/tensorflow/tensorflow/commit/6364463d6f5b6254cac3d6aedf999b6a96225038
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-69.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-124.yaml
- https://github.com/tensorflow/tensorflow
- https://github.com/tensorflow/tensorflow/blob/ca6f96b62ad84207fbec580404eaa7dd7403a550/tensorflow/lite/kernels/internal/utils/sparsity_format_converter.cc#L252-L293
CVE-2022-23560 · published · modified · JSON
PyPI/tensorflow-cpu CVE-2022-23560: high 8.8, EPSS 0.84%
Read and Write outside of bounds in TensorFlow
Action: Upgrade tensorflow-cpu to 2.5.3 or later.
pip install tensorflow-cpu==2.5.3pip install tensorflow-cpu==2.6.3pip install tensorflow-cpu==2.7.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.5.3 | - |
| 2.6.0 | 2.6.3 | - |
| 2.7.0 | 2.7.1 | - |
Fixed versions
| 2.5.3 | 2.6.3 | 2.7.1 |
Sources
- osv: GHSA-4hvf-hxvg-f67v#PyPI/tensorflow-cpu
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-4hvf-hxvg-f67v
- https://nvd.nist.gov/vuln/detail/CVE-2022-23560
- https://github.com/tensorflow/tensorflow/commit/6364463d6f5b6254cac3d6aedf999b6a96225038
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-69.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-124.yaml
- https://github.com/tensorflow/tensorflow
- https://github.com/tensorflow/tensorflow/blob/ca6f96b62ad84207fbec580404eaa7dd7403a550/tensorflow/lite/kernels/internal/utils/sparsity_format_converter.cc#L252-L293
CVE-2022-23560 · published · modified · JSON
PyPI/tensorflow-gpu CVE-2022-23560: high 8.8, EPSS 0.84%
Read and Write outside of bounds in TensorFlow
Action: Upgrade tensorflow-gpu to 2.5.3 or later.
pip install tensorflow-gpu==2.5.3pip install tensorflow-gpu==2.6.3pip install tensorflow-gpu==2.7.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.5.3 | - |
| 2.6.0 | 2.6.3 | - |
| 2.7.0 | 2.7.1 | - |
Fixed versions
| 2.5.3 | 2.6.3 | 2.7.1 |
Sources
- osv: GHSA-4hvf-hxvg-f67v#PyPI/tensorflow-gpu
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-4hvf-hxvg-f67v
- https://nvd.nist.gov/vuln/detail/CVE-2022-23560
- https://github.com/tensorflow/tensorflow/commit/6364463d6f5b6254cac3d6aedf999b6a96225038
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-69.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-124.yaml
- https://github.com/tensorflow/tensorflow
- https://github.com/tensorflow/tensorflow/blob/ca6f96b62ad84207fbec580404eaa7dd7403a550/tensorflow/lite/kernels/internal/utils/sparsity_format_converter.cc#L252-L293
CVE-2022-23560 · published · modified · JSON
PyPI/tensorflow-gpu CVE-2022-23560: unknown, EPSS 0.84%
Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would allow limited reads and writes outside of arrays in TFLite. This exploits missing validation in
Action: Upgrade tensorflow-gpu to 2.5.3 or later.
pip install tensorflow-gpu==2.5.3pip install tensorflow-gpu==2.6.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.5.3 | - |
| 2.6.0 | 2.6.3 | - |
Fixed versions
| 2.5.3 | 2.6.3 |
Sources
- osv: PYSEC-2022-124
- https://github.com/tensorflow/tensorflow/commit/6364463d6f5b6254cac3d6aedf999b6a96225038
- https://github.com/tensorflow/tensorflow/blob/ca6f96b62ad84207fbec580404eaa7dd7403a550/tensorflow/lite/kernels/internal/utils/sparsity_format_converter.cc#L252-L293
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-4hvf-hxvg-f67v
CVE-2022-23560 · published · modified · JSON
PyPI/tensorflow-cpu CVE-2022-23560: unknown, EPSS 0.84%
Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would allow limited reads and writes outside of arrays in TFLite. This exploits missing validation in
Action: Upgrade tensorflow-cpu to 2.5.3 or later.
pip install tensorflow-cpu==2.5.3pip install tensorflow-cpu==2.6.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.5.3 | - |
| 2.6.0 | 2.6.3 | - |
Fixed versions
| 2.5.3 | 2.6.3 |
Sources
- osv: PYSEC-2022-69
- https://github.com/tensorflow/tensorflow/commit/6364463d6f5b6254cac3d6aedf999b6a96225038
- https://github.com/tensorflow/tensorflow/blob/ca6f96b62ad84207fbec580404eaa7dd7403a550/tensorflow/lite/kernels/internal/utils/sparsity_format_converter.cc#L252-L293
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-4hvf-hxvg-f67v
CVE-2022-23560 · published · modified · JSON
PyPI/tensorflow CVE-2022-23560: high 8.8, EPSS 0.84%
Read and Write outside of bounds in TensorFlow
Action: Upgrade tensorflow to 2.5.3 or later.
pip install tensorflow==2.5.3pip install tensorflow==2.6.3pip install tensorflow==2.7.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.5.3 | - |
| 2.6.0 | 2.6.3 | - |
| 2.7.0 | 2.7.1 | - |
Fixed versions
| 2.5.3 | 2.6.3 | 2.7.1 |
Sources
- osv: PYSEC-2026-3099
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-4hvf-hxvg-f67v
- https://nvd.nist.gov/vuln/detail/CVE-2022-23560
- https://github.com/tensorflow/tensorflow/commit/6364463d6f5b6254cac3d6aedf999b6a96225038
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-69.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-124.yaml
- https://github.com/tensorflow/tensorflow
- https://github.com/tensorflow/tensorflow/blob/ca6f96b62ad84207fbec580404eaa7dd7403a550/tensorflow/lite/kernels/internal/utils/sparsity_format_converter.cc#L252-L293
- https://pypi.org/project/tensorflow
- https://github.com/advisories/GHSA-4hvf-hxvg-f67v
CVE-2022-23560 · published · modified · JSON