{"action":"Upgrade tensorflow-cpu to 2.4.0 or later.","affected":[{"fixed":"2.4.0","introduced":"0"}],"component":"tensorflow-cpu","cve_ids":["CVE-2020-15265"],"ecosystem":"PyPI","epss":0.00908,"exploited":false,"fixed_versions":["2.4.0"],"ghsa_id":"GHSA-rrfp-j2mp-hq9c","id":"tcs_01M5KGAAF0AS0JR0D8GQ5QHVCJ","modified_at":"2023-12-06T01:00:17.606171Z","published_at":"2020-10-21T21:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-295","https://github.com/tensorflow/tensorflow/commit/eccb7ec454e6617738554a255d77f08e60ee0808","https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rrfp-j2mp-hq9c","https://github.com/tensorflow/tensorflow/issues/42105"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2020-295","url":"https://osv.dev/vulnerability/PYSEC-2020-295"}],"summary":"In Tensorflow before version 2.4.0, an attacker can pass an invalid `axis` value to `tf.quantization.quantize_and_dequantize`. This results in accessing a dimension outside the rank of the input tenso"}