Lucene search

K
osvGoogleOSV:PYSEC-2021-252
HistoryMay 14, 2021 - 8:15 p.m.

PYSEC-2021-252

2021-05-1420:15:00
Google
osv.dev
10
tensorflow
parseattrvalue
stack overflow
vulnerability
2.5.0
cherrypick
commit
supported range

EPSS

0

Percentile

12.8%

TensorFlow is an end-to-end open source platform for machine learning. The implementation of ParseAttrValue(https://github.com/tensorflow/tensorflow/blob/c22d88d6ff33031aa113e48aa3fc9aa74ed79595/tensorflow/core/framework/attr_value_util.cc#L397-L453) can be tricked into stack overflow due to recursion by giving in a specially crafted input. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

EPSS

0

Percentile

12.8%