Security Bulletin: Multiple vulnerabilities fixed in IBM Maximo Application Suite Monitor

Summary IBM Maximo Application Suite Monitor is vulnerable to Multiple vulnerabilities. See Vulnerability Details. This has been addressed in each of the components; refer to the Remediation section for details. Vulnerability Details CVEID: CVE-2020-15265 DESCRIPTION: Tensorflow is vulnerable to ...

Security Bulletin: TensorFlow in Watson Machine Learning Community Edition 1.6.2 and 1.7.0 has been patched for various security issues.

Summary TensorFlow in Watson Machine Learning Community Edition 1.6.2 and 1.7.0 has had various CVE reported against it and have been patched. Users should update to the latest available TensorFlow package. Vulnerability Details CVEID: CVE-2020-15265 DESCRIPTION: Tensorflow is vulnerable to a...

optimuspyspark (>=2.0.4, <=2.0.6), pytorch-es (>=0.1.0, <=0.1.1) +2 more potentially affected by CVE-2020-15265 via tensorflow (1.6.0)

tensorflow PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - optimuspyspark =2.0.4, =0.1.0, =0.12.0, =0.7.2, =0.10.0 Source cves: CVE-2020-15265 Source advisory: OSV:GHSA-RRFP-J2MP-HQ9C...

cellunet (>=0.1.0, <=0.2.2), color2vec (1.0.0) +12 more potentially affected by CVE-2020-15265 via tensorflow (1.8.0)

tensorflow PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cellunet =0.1.0, =0.0.5.1, =0.1.0, =0.1.1.1, =1.1.0, =0.9.0a7, =0.1.0, =0.11.0, =0.4.1, =0.5.2, =0.5.5 Source cves: CVE-2020-15265 Source...

cf-nlp (>=0.1.0, <=0.1.1), dlgo (0.2.0) +2 more potentially affected by CVE-2020-15265 via tensorflow (1.10.1)

tensorflow PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cf-nlp =0.1.0, =0.6.0, =0.6.1 Source cves: CVE-2020-15265 Source advisory: OSV:GHSA-RRFP-J2MP-HQ9C...

alfabet (0.0.5), alibi (>=0.3.1, <=0.5.1) +67 more potentially affected by CVE-2020-15265 via tensorflow (1.15.5)

tensorflow PYPI version 1.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - alfabet 0.0.5 - alibi =0.3.1, =0.1.0, =1.0.2, =0.1.0a3, =0.1.1, =0.0.1, =0.1.14, =0.2.0, =0.0.1, =0.1.0, =0.7.0 and more Source cves:...

axelerate (>=0.5.2, <=0.5.5), bert-experimental (1.0.0) +24 more potentially affected by CVE-2020-15265 via tensorflow (1.15.2)

tensorflow PYPI version 1.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - axelerate =0.5.2, =2.0.1, =1.0.1, =0.1.0.dev1, =1.5.0.dev20210429, =1.5.0.dev20210512 - fedlearner-manylinux 1.5.0.dev20210429 -...

axelerate (>=0.5.8, <=0.5.9), bianbu-ai-toolkit-tf1 (1.0.6) +27 more potentially affected by CVE-2020-15265 via tensorflow (1.15.3)

tensorflow PYPI version 1.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - axelerate =0.5.8, =0.0.1.2, =0.0.13, =1.1.0, =0.22.0, =1.6.0, =4.1.3, =0.10.0.dev1, =0.11.0 - muffnn 2.3.1 - neoepiscope 0.4.0 and more...

sklearn-plus (>=0.0.3, <=0.0.4) potentially affected by CVE-2020-15265 via tensorflow (1.2.0)

tensorflow PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - sklearn-plus =0.0.3, =0.0.4 Source cves: CVE-2020-15265 Source advisory: OSV:GHSA-RRFP-J2MP-HQ9C...

azureml-designer-recommender-modules (>=0.0.1, <=0.0.9), d3m-simon (1.2.5) +24 more potentially affected by CVE-2020-15265 via tensorflow-gpu (>=2.0.0, <=2.3.4)

tensorflow-gpu PYPI version =2.0.0, =0.0.1, =1.1.0, =0.1.1, =0.1.0, =0.2.0, =0.6.4, =0.8.2 - maupassant 0.1.1 - mlreflect 0.16.0 - monk-cuda100 0.0.1 - monk-cuda100-test 0.0.1 - monk-cuda101 0.0.1 - monk-cuda101-test 0.0.1 and more Source cves: CVE-2020-15265 Source advisory: OSV:GHSA-RRFP-J2MP-H...

c4v-py (>=0.1.0.dev1, <=0.1.0.dev202107081840), pycnet-audio (>=0.5.1, <=0.5.8) +2 more potentially affected by CVE-2020-15265 via tensorflow-cpu (>=2.1.0, <=2.3.1)

tensorflow-cpu PYPI version =2.1.0, =0.1.0.dev1, =0.5.1, =0.102.0.dev0, =1.5.2, =1.7.4 Source cves: CVE-2020-15265 Source advisory: GHSA-RRFP-J2MP-HQ9C...

vcap (>=0.2.4.dev13, <=0.3.1) potentially affected by CVE-2020-15265 via tensorflow-gpu (1.15.4)

tensorflow-gpu PYPI version 1.15.4 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - vcap =0.2.4.dev13, =0.3.1 Source cves: CVE-2020-15265 Source advisory: OSV:GHSA-RRFP-J2MP-HQ9C...

CVE-2020-15265

In Tensorflow before version 2.4.0, an attacker can pass an invalid axis value to tf.quantization.quantizeanddequantize. This results in accessing a dimension outside the rank of the input tensor in the C++ kernel implementation. However, dimsize only does a DCHECK to validate the argument and th...

accuinsight (1.0.1), aimodelshare (0.1.52) +84 more potentially affected by CVE-2020-15265 via tensorflow (1.13.1)

tensorflow PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - accuinsight 1.0.1 - aimodelshare 0.1.52 - amber-automl =0.1.0, =19.3.0, =1.0.1, =1.1.0, =0.0.1, =0.3.4, =0.1.0, =0.0.1, =0.0.0.45.8, =1.1.1...

mlbench-core (>=2.4.0.dev276, <=2.4.0.dev279), openml-keras (0.0.0) +8 more potentially affected by CVE-2020-15265 via tensorflow (1.13.2)

tensorflow PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - mlbench-core =2.4.0.dev276, =0.1.0, =0.4.0, =0.14.0, =0.1.4, =0.3.0, =0.3.4 - rasa-print 0.3.1 Source cves: CVE-2020-15265 Source advisory:...

abba-python (>=0.1.6, <=0.3.0), adversal-embedding (>=0.0.1, <=0.0.7) +52 more potentially affected by CVE-2020-15265 via tensorflow (1.15.0)

tensorflow PYPI version 1.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - abba-python =0.1.6, =0.0.1, =0.2.6, =2023.1.0, =0.2.11, =0.0.4, =0.10.0, =0.10.1 - deepaclive 0.1.0 and more Source cves: CVE-2020-15265...

hyperparameter-hunter (>=0.0.1, <=1.0.1), malaya (>=0.6.0.2, <=0.6.4) +2 more potentially affected by CVE-2020-15265 via tensorflow (1.5.0)

tensorflow PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - hyperparameter-hunter =0.0.1, =0.6.0.2, =1.3.6, =1.3.7 - talos 0.6.4 Source cves: CVE-2020-15265 Source advisory: OSV:PYSEC-2020-138...

optimuspyspark (>=2.0.4, <=2.0.6), pytorch-es (>=0.1.0, <=0.1.1) +2 more potentially affected by CVE-2020-15265 via tensorflow (1.6.0)

tensorflow PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - optimuspyspark =2.0.4, =0.1.0, =0.12.0, =0.7.2, =0.10.0 Source cves: CVE-2020-15265 Source advisory: OSV:PYSEC-2020-138...

niftynet (0.1.1rc58) potentially affected by CVE-2020-15265 via tensorflow-gpu (1.1.0)

tensorflow-gpu PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - niftynet 0.1.1rc58 Source cves: CVE-2020-15265 Source advisory: OSV:PYSEC-2020-330...

cf-nlp (>=0.1.0, <=0.1.1), dlgo (0.2.0) +2 more potentially affected by CVE-2020-15265 via tensorflow (1.10.1)

tensorflow PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cf-nlp =0.1.0, =0.6.0, =0.6.1 Source cves: CVE-2020-15265 Source advisory: OSV:PYSEC-2020-138...