PYSEC-2021-417

2021-11-0523:15:00

Google

osv.dev

tensorflow

grappler optimizer

uninitialized variable

2.7.0

2.6.1

2.5.2

2.4.4

EPSS

0.001

Percentile

17.8%

JSON

TensorFlow is an open source platform for machine learning. In affected versions TensorFlow’s Grappler optimizer has a use of unitialized variable. If the train_nodes vector (obtained from the saved model that gets optimized) does not contain a Dequeue node, then dequeue_node is left unitialized. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.