CVE-2020-5215

In TensorFlow before 1.15.2 and 2.0.1, converting a string from Python to a tf.float16 value results in a segmentation fault in eager mode as the format checks for this use case are only in the graph mode. This issue can lead to denial of service in inference/training where a malicious attacker c...

Security Bulletin: Tensor Flow security vulnerabilities with segmentation fault on IBM Watson Machine Learning on CP4D

Summary TensorFlow is vulnerable to a denial of service and segmentation fault on IBM Watson Machine Learning on CP4D Vulnerability Details CVEID: CVE-2020-5215 DESCRIPTION: Tensorflow is vulnerable to a denial of service, caused by a flaw when converting a string from Python to a tf.float16 valu...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in TensorFlow

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of TensorFlow. Vulnerability Details CVEID: CVE-2020-5215 DESCRIPTION: Tensorflow is vulnerable to a denial of service, caused by a flaw when converting a string from Python to a tf.float16 value. By sending a...

abba-python (>=0.1.6 <=0.3.0), adpred (>=1.1.2 <=1.2.7) +217 more potentially affected by CVE-2020-5215 via tensorflow (>=1.0.1 <=1.15.0)

tensorflow PYPI version =1.0.1, =0.1.6, =1.1.2, =0.0.1, =0.3.26, =0.2.0, =0.4.2, =0.1.1, =0.1.5 - autobazaar =0.1.0 - autogan =0.0.5 - automationobjectdetection-sandeepjena7 =0.0.1 - automl-lib =0.0.1 and more Source cves: CVE-2020-5215 Source advisory: OSV:PYSEC-2020-258...

ai4bharat-transliteration (>=1.1.0 <=1.1.3), aipack (>=0.0.1 <=0.0.5) +44 more potentially affected by CVE-2020-5215 via tensorflow (=2.0.0)

tensorflow PYPI version =2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - ai4bharat-transliteration =1.1.0, =0.0.1, =0.1.3.2, =0.2.6, =0.2.0, =0.0.2, =0.0.1, =0.1.3, =1.0.0, =1.0.1 - eelsfitter =0.0.1 -...

gamornet-cpu (>=0.2.3 <=0.4.3), tchatbot (=0.1.0) +1 more potentially affected by CVE-2020-5215 via tensorflow-cpu (=1.15.0)

tensorflow-cpu PYPI version =1.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - gamornet-cpu =0.2.3, =0.7.0, =0.7.5 Source cves: CVE-2020-5215 Source advisory: OSV:PYSEC-2020-303...

azureml-designer-recommender-modules (=0.0.1), monk-cuda100 (=0.0.1) +9 more potentially affected by CVE-2020-5215 via tensorflow-gpu (=2.0.0)

tensorflow-gpu PYPI version =2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - azureml-designer-recommender-modules =0.0.1 - monk-cuda100 =0.0.1 - monk-cuda100-test =0.0.1 - monk-cuda101 =0.0.1 -...

arekit (>=0.21.0 <=0.22.1), arenets (>=0.23.0 <=0.23.1) +42 more potentially affected by CVE-2020-5215 via tensorflow-gpu (>=1.10.1 <=1.15.0)

tensorflow-gpu PYPI version =1.10.1, =0.21.0, =0.23.0, =0.1.0, =0.1.0, =1.0.0, =0.2.3, =0.0.1, =0.0.7, =0.1.0, =0.1.5 and more Source cves: CVE-2020-5215 Source advisory: OSV:GHSA-977J-XJ7Q-2JR9...

gamornet-cpu (>=0.2.3 <=0.4.3), tchatbot (=0.1.0) +1 more potentially affected by CVE-2020-5215 via tensorflow-cpu (=1.15.0)

tensorflow-cpu PYPI version =1.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - gamornet-cpu =0.2.3, =0.7.0, =0.7.5 Source cves: CVE-2020-5215 Source advisory: OSV:GHSA-977J-XJ7Q-2JR9...

abba-python (>=0.1.6 <=0.3.0), adpred (>=1.1.2 <=1.2.7) +217 more potentially affected by CVE-2020-5215 via tensorflow (>=1.0.1 <=1.15.0)

tensorflow PYPI version =1.0.1, =0.1.6, =1.1.2, =0.0.1, =0.3.26, =0.2.0, =0.4.2, =0.1.1, =0.1.5 - autobazaar =0.1.0 - autogan =0.0.5 - automationobjectdetection-sandeepjena7 =0.0.1 - automl-lib =0.0.1 and more Source cves: CVE-2020-5215 Source advisory: OSV:GHSA-977J-XJ7Q-2JR9...

CVE-2020-5215

CVE-2020-5215 affects TensorFlow before 1.15.2 and 2.0.1, where converting a Python string to tf.float16 in eager mode can trigger a segmentation fault. The issue arises because format checks for this use case exist only in graph mode, potentially enabling denial of service during inference/train...