Veracode Vulnerability DatabaseVERACODE:38165Denial Of Service (DoS)
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.001 Low
EPSS
Percentile
30.0%
Tensorflow is vulnerable to denial of service. The vulnerability exists because the element_shape input is not properly validated which allows an attacker to cause an application crash due to a segmentation fault.
References
github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/list_kernels.h
github.com/tensorflow/tensorflow/commit/32d74717d9bf04d0a07958129d93fade1677b390
github.com/tensorflow/tensorflow/commit/7889a8e0da8e6ced697d1a240fb2458070d3047f
github.com/tensorflow/tensorflow/commit/bed6864eb8fdc193e395821fee9ff1f7dfd73bbc
github.com/tensorflow/tensorflow/commit/fc33f3dc4c14051a83eec6535b608abe1d355fde
github.com/tensorflow/tensorflow/security/advisories/GHSA-66vq-54fq-6jvv
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.001 Low
EPSS
Percentile
30.0%