Lucene search

[email protected]CVE-2020-15203

HistorySep 25, 2020 - 7:15 p.m.

CVE-2020-15203

2020-09-2519:15:15

CWE-134

CWE-20

[email protected]

web.nvd.nist.gov

136

cve

2020

15203

tensorflow

format string vulnerability

security issue

patch

nvd

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.2 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.8%

JSON

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the fill argument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a printf call is constructed. This may result in segmentation fault. The issue is patched in commit 33be22c65d86256e6826666662e40dbdfe70ee83, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Affected configurations

Vulners

NVD

Node

tensorflowtensorflowRange<1.15.4

tensorflowtensorflowRange2.0.0–2.0.3

tensorflowtensorflowRange2.1.0–2.1.2

tensorflowtensorflowRange2.2.0–2.2.1

tensorflowtensorflowRange2.3.0–2.3.1

CPENameOperatorVersion
google:tensorflowgoogle tensorflowlt1.15.4
google:tensorflowgoogle tensorflowlt2.0.3
google:tensorflowgoogle tensorflowlt2.1.2
google:tensorflowgoogle tensorflowlt2.2.1
google:tensorflowgoogle tensorflowlt2.3.1

CPE	Name	Operator	Version
google:tensorflow	google tensorflow	lt	1.15.4
google:tensorflow	google tensorflow	lt	2.0.3
google:tensorflow	google tensorflow	lt	2.1.2
google:tensorflow	google tensorflow	lt	2.2.1
google:tensorflow	google tensorflow	lt	2.3.1

CNA Affected

[
  {
    "product": "tensorflow",
    "vendor": "tensorflow",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.15.4"
      },
      {
        "status": "affected",
        "version": ">= 2.0.0, < 2.0.3"
      },
      {
        "status": "affected",
        "version": ">= 2.1.0, < 2.1.2"
      },
      {
        "status": "affected",
        "version": ">= 2.2.0, < 2.2.1"
      },
      {
        "status": "affected",
        "version": ">= 2.3.0, < 2.3.1"
      }
    ]
  }
]