Missing validation results in undefined behavior in `SparseTensorDenseAdd

ImpactThe implementation of tf.rawops.SparseTensorDenseAdd does not fully validate the input arguments:pythonimport tensorflow as tfaindices = tf.constant0, shape=17, 2, dtype=tf.int64avalues = tf.constant, shape=0, dtype=tf.float32ashape = tf.constant6, 12, shape=2, dtype=tf.int64b =...

Missing validation causes denial of service via `Conv3DBackpropFilterV2`

ImpactThe implementation of tf.rawops.UnsortedSegmentJoin does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:pythonimport tensorflow as tftf.strings.unsortedsegmentjoin inputs='123', segmentids=0, numsegments=-1The...

alfabet (0.0.5), alibi (>=0.3.1, <=0.4.0) +67 more potentially affected by CVE-2022-29202 via tensorflow (1.15.5)

tensorflow PYPI version 1.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - alfabet 0.0.5 - alibi =0.3.1, =0.1.0, =1.0.2, =0.1.0a3, =0.1.1, =0.0.1, =0.1.14, =0.2.0, =0.0.1, =0.1.0, =0.7.0 and more Source cves:...

aether (>=0.3.26, <=0.3.32), animalai-train (>=0.4.2, <=0.5.0) +26 more potentially affected by CVE-2022-29202 via tensorflow (1.12.0)

tensorflow PYPI version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - aether =0.3.26, =0.4.2, =1.0.17.1, =0.1.0, =0.3.1, =0.1.0, =0.0.1, =1.0.0, =0.7.0, =0.8.0 and more Source cves: CVE-2022-29202 Source...

animalai-train (>=0.6.0, <=1.0.3), coach-cli (0.91.0) +3 more potentially affected by CVE-2022-29202 via tensorflow (1.12.2)

tensorflow PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train =0.6.0, =0.10.0, =0.3.2, =0.4.3 Source cves: CVE-2022-29202 Source advisory: OSV:PYSEC-2026-3163...

azureml-automl-core (>=1.0.23, <=1.0.33), kassandra (0.0.1) +3 more potentially affected by CVE-2022-29202 via tensorflow (1.11.0)

tensorflow PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - azureml-automl-core =1.0.23, =2.0.2, =0.3.4, =0.6.2, =0.6.5 Source cves: CVE-2022-29202 Source advisory: OSV:PYSEC-2026-3163...

keras-pandas (>=1.1.2, <=2.0.1), learna-tools (0.1.0) potentially affected by CVE-2022-29202 via tensorflow (1.4.0)

tensorflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - keras-pandas =1.1.2, =2.0.1 - learna-tools 0.1.0 Source cves: CVE-2022-29202 Source advisory: OSV:PYSEC-2026-3163...

Integer overflow in `SpaceToBatchND`

ImpactThe implementation of tf.rawops.SpaceToBatchND in all backends such as XLA and handwritten kernels is vulnerable to an integer overflow:pythonimport tensorflow as tfinput = tf.constant-3.5e+35, shape=10,19,22, dtype=tf.float32blockshape = tf.constant-1879048192, shape=2,...

abmarl (>=0.1.1, <=0.1.3), accuinsight (>=1.0.47, <=3.0.0) +516 more potentially affected by CVE-2022-29201 via tensorflow (>=2.0.0, <=2.6.3)

tensorflow PYPI version =2.0.0, =0.1.1, =1.0.47, =1.0.0, =1.2.0, =1.1.5, =0.0.1, =2.1.0, =0.5.6, =0.5.0, =0.1.0, =0.1.8 and more Source cves: CVE-2022-29201 Source advisory: OSV:PYSEC-2026-3224...

chicksexer (0.2.2), gender-detection (0.2.2) +2 more potentially affected by CVE-2022-29201 via tensorflow (1.0.1)

tensorflow PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - chicksexer 0.2.2 - gender-detection 0.2.2 - moodleinspire 0.0.10 - moodlemlbackend =0.0.2, =1.0.0 Source cves: CVE-2022-29201 Source advisor...

azureml-automl-core (>=1.0.23, <=1.0.33), kassandra (0.0.1) +3 more potentially affected by CVE-2022-29201 via tensorflow (1.11.0)

tensorflow PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - azureml-automl-core =1.0.23, =2.0.2, =0.3.4, =0.6.2, =0.6.5 Source cves: CVE-2022-29201 Source advisory: OSV:PYSEC-2026-3224...

Segfault due to missing support for quantized types

ImpactThere is a potential for segfault / denial of service in TensorFlow by calling tf.compat.v1. ops which don't yet have support for quantized types added after migration to TF 2.x:pythonimport numpy as npimport tensorflow as...

cde (>=0.1.0, <=0.2.0.1), nerlogparser (0.0.1) +1 more potentially affected by CVE-2022-29201 via tensorflow (1.4.1)

tensorflow PYPI version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cde =0.1.0, =0.1.7, =0.3.2 Source cves: CVE-2022-29201 Source advisory: OSV:PYSEC-2026-3224...

animalai-train (>=0.6.0, <=1.0.3), coach-cli (0.91.0) +3 more potentially affected by CVE-2022-29204 via tensorflow (1.12.2)

tensorflow PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train =0.6.0, =0.10.0, =0.3.2, =0.4.3 Source cves: CVE-2022-29204 Source advisory: OSV:PYSEC-2026-3203...

aether (>=0.3.26, <=0.3.32), animalai-train (>=0.4.2, <=0.5.0) +26 more potentially affected by CVE-2022-29203 via tensorflow (1.12.0)

tensorflow PYPI version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - aether =0.3.26, =0.4.2, =1.0.17.1, =0.1.0, =0.3.1, =0.1.0, =0.0.1, =1.0.0, =0.7.0, =0.8.0 and more Source cves: CVE-2022-29203 Source...

autogan (0.0.5), deepctr (0.3.3) +8 more potentially affected by CVE-2022-29202 via tensorflow (1.12.3)

tensorflow PYPI version 1.12.3 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - autogan 0.0.5 - deepctr 0.3.3 - opveclib 1.0.0 - polyaxon-lib =0.0.3, =0.14.0a5, =0.13.0, =1.0.1, =1.9.1, =0.1.0, =0.3.1 Source cves:...

optimuspyspark (>=2.0.4, <=2.0.6), pytorch-es (>=0.1.0, <=0.1.1) +2 more potentially affected by CVE-2022-29203 via tensorflow (1.6.0)

tensorflow PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - optimuspyspark =2.0.4, =0.1.0, =0.12.0, =0.7.2, =0.10.0 Source cves: CVE-2022-29203 Source advisory: OSV:PYSEC-2026-3207...

animalai-train (>=0.6.0, <=1.0.3), coach-cli (0.91.0) +3 more potentially affected by CVE-2022-29205 via tensorflow (1.12.2)

tensorflow PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train =0.6.0, =0.10.0, =0.3.2, =0.4.3 Source cves: CVE-2022-29205 Source advisory: OSV:PYSEC-2026-3104...

sklearn-plus (>=0.0.3, <=0.0.4) potentially affected by CVE-2022-29206 via tensorflow (1.2.0)

tensorflow PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - sklearn-plus =0.0.3, =0.0.4 Source cves: CVE-2022-29206 Source advisory: OSV:PYSEC-2026-3235...

c4v-py (>=0.1.0.dev1, <=0.1.0.dev202107081840), medaka-cpu (1.5.0) +4 more potentially affected by CVE-2022-29203 via tensorflow-cpu (>=2.1.0, <=2.5.3)

tensorflow-cpu PYPI version =2.1.0, =0.1.0.dev1, =0.5.1, =0.102.0.dev0, =1.5.2, =1.7.4 Source cves: CVE-2022-29203 Source advisory: OSV:PYSEC-2026-3344...