Security Bulletin: TensorFlow in Watson Machine Learning 1.6.2 and 1.7.0 has been patched for a security issue in nanopb.

Summary

TensorFlow in Watson Machine Learning 1.6.2 and 1.7.0 has had various secuirty issue published for nanopb. These have been patched in the latest versions of TensorFlow.

Vulnerability Details

CVEID:CVE-2020-26243
**DESCRIPTION:**Nanopb is vulnerable to a denial of service, caused by a memory leak in oneof fields with PB_ENABLE_MALLOC. By sending a specially-crafted formed message, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/192343 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

Update to the latest version of TensorFlow from the Watson Machine Learning conda channel:

https://public.dhe.ibm.com/ibmdl/export/pub/software/server/ibm-ai/conda/

Update TensorFlow using the conda packaging manager.

For WML-CE 1.6.2 use

conda install tensorflow-gpu=1.15.5

or

conda install tensorflow=1.15.5

For WML-CE 1.7.0 use

conda install tensorflow-gpu=2.1.3

or

conda install tensorflow=2.1.3

Workarounds and Mitigations

None