CVE-2020-15211: Tensorflow Out Of Bounds Access Vulnerability
MODERATE
Advisory Identifier:
GHSA-cvpc-8phh-8f45
Advisory Summary
CVE-2020-15211 is a MODERATE (CVSS 4.8) out of bounds access vulnerability (CWE-125: Out-of-bounds Read) affecting Tensorflow libraries in the PyPI ecosystem. The issue involves out of bounds access in tensorflow-lite. Remediation is available by upgrading affected packages to version 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1.
CVE-2020-15211 at a Glance
CVE Identifier
CVE-2020-15211
GHSA Identifier
GHSA-cvpc-8phh-8f45
Severity
MODERATE
CVSS v3.1 Base Score
4.8
CWE Classification
CWE-125: Out-of-bounds Read
Affected Product
Tensorflow
Package Ecosystem
PyPI
Published Date
Last Updated
Security Impact
CVSS: 4.8
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
Attack Vector
Network (AV:N)
Attack Complexity
High (AC:H)
Privileges Required
None (PR:N)
User Interaction
None (UI:N)
Scope
Unchanged (S:U)
Confidentiality
Low (C:L)
Integrity
Low (I:L)
Availability
None (A:N)
How to Fix CVE-2020-15211
To remediate this vulnerability, upgrade all affected Tensorflow dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
tensorflow
fixed: 1.15.4
pip install tensorflow>=1.15.4
tensorflow
fixed: 2.0.3
pip install tensorflow>=2.0.3
tensorflow
fixed: 2.1.2
pip install tensorflow>=2.1.2
tensorflow
fixed: 2.2.1
pip install tensorflow>=2.2.1
tensorflow
fixed: 2.3.1
pip install tensorflow>=2.3.1
tensorflow-cpu
fixed: 1.15.4
pip install tensorflow-cpu>=1.15.4
tensorflow-cpu
fixed: 2.0.3
pip install tensorflow-cpu>=2.0.3
tensorflow-cpu
fixed: 2.1.2
pip install tensorflow-cpu>=2.1.2
tensorflow-cpu
fixed: 2.2.1
pip install tensorflow-cpu>=2.2.1
tensorflow-cpu
fixed: 2.3.1
pip install tensorflow-cpu>=2.3.1
tensorflow-gpu
fixed: 1.15.4
pip install tensorflow-gpu>=1.15.4
tensorflow-gpu
fixed: 2.0.3
pip install tensorflow-gpu>=2.0.3
tensorflow-gpu
fixed: 2.1.2
pip install tensorflow-gpu>=2.1.2
tensorflow-gpu
fixed: 2.2.1
pip install tensorflow-gpu>=2.2.1
tensorflow-gpu
fixed: 2.3.1
pip install tensorflow-gpu>=2.3.1
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
pip show tensorflowHow to Check if You Are Affected
To determine whether your Python environment is affected by CVE-2020-15211, inspect your installed packages using pip:
pip show tensorflowAnalyze the terminal output to locate any version of Tensorflow in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.15.4), your application is affected.
Note: The pip show tensorflow command checks currently installed packages in your active Python environment.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-125: Out-of-bounds Read, where the product reads data past the end, or before the beginning, of the intended buffer. In Tensorflow, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
### Impact
In TensorFlow Lite, saved models in the flatbuffer format use a double indexing scheme: a model has a set of subgraphs, each subgraph has a set of operators and each operator has a set of input/output tensors. The flatbuffer format uses indices for the tensors, indexing into an array of tensors that is owned by the subgraph. This results in a pattern of double array indexing when trying to get the data of each tensor: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/kernel_util.cc#L36
However, some operators can have some tensors be optional. To handle this scenario, the flatbuffer model uses a negative `-1` value as index for these tensors:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/c/common.h#L82
This results in special casing during validation at model loading time: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/core/subgraph.cc#L566-L580
Unfortunately, this means that the `-1` index is a valid tensor index for any operator, including those that don't expect optional inputs and including for output tensors. Thus, this allows writing and reading from outside the bounds of heap allocated arrays, although only at a specific offset from the start of these arrays.
This results in both read and write gadgets, albeit very limited in scope.
### Patches
We have patched the issue in several commits (46d5b0852, 00302787b7, e11f5558, cd31fd0ce, 1970c21, and fff2c83). We will release patch releases for all versions between 1.15 and 2.3.
We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
### Workarounds
A potential workaround would be to add a custom `Verifier` to the model loading code to ensure that only operators which accept optional inputs use the `-1` special value and only for the tensors that they expect to be optional. Since this allow-list type approach is erro-prone, we advise upgrading to the patched code.
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
CVE-2020-15211 Affected Tensorflow Versions
15 component(s)
Fixed Versions:
1.15.42.0.32.1.22.2.12.3.1
| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
tensorflow
|
PyPI |
< 1.15.4
|
1.15.4
|
|
tensorflow
|
PyPI |
≥ 2.0.0
< 2.0.3
|
2.0.3
|
|
tensorflow
|
PyPI |
≥ 2.1.0
< 2.1.2
|
2.1.2
|
|
tensorflow
|
PyPI |
≥ 2.2.0
< 2.2.1
All 1 versions
2.2.0
|
2.2.1
|
|
tensorflow
|
PyPI |
≥ 2.3.0
< 2.3.1
All 1 versions
2.3.0
|
2.3.1
|
|
tensorflow-cpu
|
PyPI |
< 1.15.4
|
1.15.4
|
|
tensorflow-cpu
|
PyPI |
≥ 2.0.0
< 2.0.3
|
2.0.3
|
|
tensorflow-cpu
|
PyPI |
≥ 2.1.0
< 2.1.2
|
2.1.2
|
|
tensorflow-cpu
|
PyPI |
≥ 2.2.0
< 2.2.1
All 1 versions
2.2.0
|
2.2.1
|
|
tensorflow-cpu
|
PyPI |
≥ 2.3.0
< 2.3.1
All 1 versions
2.3.0
|
2.3.1
|
|
tensorflow-gpu
|
PyPI |
< 1.15.4
|
1.15.4
|
|
tensorflow-gpu
|
PyPI |
≥ 2.0.0
< 2.0.3
|
2.0.3
|
|
tensorflow-gpu
|
PyPI |
≥ 2.1.0
< 2.1.2
|
2.1.2
|
|
tensorflow-gpu
|
PyPI |
≥ 2.2.0
< 2.2.1
All 1 versions
2.2.0
|
2.2.1
|
|
tensorflow-gpu
|
PyPI |
≥ 2.3.0
< 2.3.1
All 1 versions
2.3.0
|
2.3.1
|
References
GitHub Advisory / Wiki
ADVISORY
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-cvpc-8phh-8f45
NVD — CVE-2020-15211
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-15211
Security Fix Commit
FIX COMMIT
https://github.com/tensorflow/tensorflow/commit/fff2c8326280c07733828f990548979bdc893859
Security Fix Commit
FIX COMMIT
https://github.com/tensorflow/tensorflow/commit/f911af101dc0ce0eec17a8740bec9b613ae4195e
Security Fix Commit
FIX COMMIT
https://github.com/tensorflow/tensorflow/commit/e6b213cebb56f485bd400961a2ed109aeeac9d3c
Security Fix Commit
FIX COMMIT
https://github.com/tensorflow/tensorflow/commit/e47eb1453f35666795a31e208c28922b08756c69
Security Fix Commit
FIX COMMIT
https://github.com/tensorflow/tensorflow/commit/e11f55585f614645b360563072ffeb5c3eeff162
Security Fix Commit
FIX COMMIT
https://github.com/tensorflow/tensorflow/commit/d8f8236c29744b8e3247c083fd21c9a87180505c
Security Fix Commit
FIX COMMIT
https://github.com/tensorflow/tensorflow/commit/cd31fd0ce0449a9e0f83dcad08d6ed7f1d6bef3f
Security Fix Commit
FIX COMMIT
https://github.com/tensorflow/tensorflow/commit/c22736982844d19af623ccd7d33e2d199493eee7
Security Fix Commit
FIX COMMIT
https://github.com/tensorflow/tensorflow/commit/7e283f97d8c784d3eae5062d9de25d0f432ad239
Security Fix Commit
FIX COMMIT
https://github.com/tensorflow/tensorflow/commit/46d5b0852528ddfd614ded79bccc75589f801bd9
Security Fix Commit
FIX COMMIT
https://github.com/tensorflow/tensorflow/commit/42ed6ac86856956da65b5957a26fab130ff9471c
Security Fix Commit
FIX COMMIT
https://github.com/tensorflow/tensorflow/commit/38cbad757b2e1c0d64b95e4582408fa66627a67c
Security Fix Commit
FIX COMMIT
https://github.com/tensorflow/tensorflow/commit/1a8528bfb572884eb8137dab1bf649705c960c47
Security Fix Commit
FIX COMMIT
https://github.com/tensorflow/tensorflow/commit/1970c2158b1ffa416d159d03c3370b9a462aee35
Security Fix Commit
FIX COMMIT
https://github.com/tensorflow/tensorflow/commit/0b5be2717a19ca7bf505369eb8bdd341405d263d
Security Fix Commit
FIX COMMIT
https://github.com/tensorflow/tensorflow/commit/00302787b788c5ff04cb6f62aed5a74d936e86c0
Tensorflow Source Repository
REPOSITORY
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/kernel_util.cc#L36
Tensorflow Source Repository
REPOSITORY
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/core/subgraph.cc#L566-L580
Tensorflow Source Repository
REPOSITORY
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/c/common.h#L82
Tensorflow Source Repository
REPOSITORY
https://github.com/tensorflow/tensorflow
Tensorflow Source Repository
REPOSITORY
https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2020-134.yaml
Tensorflow Release
RELEASE
https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1
Tensorflow Source Repository
REPOSITORY
https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2020-326.yaml
Tensorflow Source Repository
REPOSITORY
https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2020-291.yaml
Tensorflow Security Information
SECURITY
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.html
Frequently Asked Questions
What is CVE-2020-15211?
CVE-2020-15211 is a security vulnerability in Tensorflow involving Out of bounds access in tensorflow-lite under CWE-125: Out-of-bounds Read.
Which Tensorflow versions are affected?
Affected versions include releases prior to 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1 across affected packages: tensorflow, tensorflow-cpu, tensorflow-gpu.
What version fixes CVE-2020-15211?
Upgrading to 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is tensorflow affected?
Yes, tensorflow is affected in releases prior to 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1. Upgrade your dependency to 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1 or later.
Is tensorflow-cpu affected?
Yes, tensorflow-cpu is affected in releases prior to 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1. Upgrade your dependency to 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1 or later.
What is the CVSS score of CVE-2020-15211?
CVE-2020-15211 has a CVSS v3.1 base score of 4.8 (MODERATE) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N.
What CWE is associated with CVE-2020-15211?
CVE-2020-15211 is classified under CWE-125: Out-of-bounds Read (The product reads data past the end, or before the beginning, of the intended buffer.).
How can I check PyPI dependencies for CVE-2020-15211?
Run the dependency tree command: 'pip show tensorflow'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-cvpc-8phh-8f45",
"modified" : "2024-10-28T15:02:07Z",
"published" : "2020-09-25T18:28:49Z",
"aliases" : [ "CVE-2020-15211" ],
"summary" : "Out of bounds access in tensorflow-lite",
"details" : "### Impact\nIn TensorFlow Lite, saved models in the flatbuffer format use a double indexing scheme: a model has a set of subgraphs, each subgraph has a set of operators and each operator has a set of input/output tensors. The flatbuffer format uses indices for the tensors, indexing into an array of tensors that is owned by the subgraph. This results in a pattern of double array indexing when trying to get the data of each tensor: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/kernel_util.cc#L36\n\nHowever, some operators can have some tensors be optional. To handle this scenario, the flatbuffer model uses a negative `-1` value as index for these tensors:\nhttps://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/c/common.h#L82\n\nThis results in special casing during validation at model loading time: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/core/subgraph.cc#L566-L580\n\nUnfortunately, this means that the `-1` index is a valid tensor index for any operator, including those that don't expect optional inputs and including for output tensors. Thus, this allows writing and reading from outside the bounds of heap allocated arrays, although only at a specific offset from the start of these arrays.\n\nThis results in both read and write gadgets, albeit very limited in scope.\n\n### Patches\nWe have patched the issue in several commits (46d5b0852, 00302787b7, e11f5558, cd31fd0ce, 1970c21, and fff2c83). We will release patch releases for all versions between 1.15 and 2.3.\n\nWe recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.\n\n### Workarounds\nA potential workaround would be to add a custom `Verifier` to the model loading code to ensure that only operators which accept optional inputs use the `-1` special value and only for the tensors that they expect to be optional. Since this allow-list type approach is erro-prone, we advise upgrading to the patched code.\n\n### For more information\nPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.\n\n### Attribution\nThis vulnerability has been reported by members of the Aivul Team from Qihoo 360.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
}, {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "PyPI",
"name" : "tensorflow"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.15.4"
} ]
} ]
}, {
"package" : {
"ecosystem" : "PyPI",
"name" : "tensorflow"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.0.0"
}, {
"fixed" : "2.0.3"
} ]
} ]
}, {
"package" : {
"ecosystem" : "PyPI",
"name" : "tensorflow"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.1.0"
}, {
"fixed" : "2.1.2"
} ]
} ]
}, {
"package" : {
"ecosystem" : "PyPI",
"name" : "tensorflow"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.2.0"
}, {
"fixed" : "2.2.1"
} ]
} ],
"versions" : [ "2.2.0" ]
}, {
"package" : {
"ecosystem" : "PyPI",
"name" : "tensorflow"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.3.0"
}, {
"fixed" : "2.3.1"
} ]
} ],
"versions" : [ "2.3.0" ]
}, {
"package" : {
"ecosystem" : "PyPI",
"name" : "tensorflow-cpu"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.15.4"
} ]
} ]
}, {
"package" : {
"ecosystem" : "PyPI",
"name" : "tensorflow-cpu"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.0.0"
}, {
"fixed" : "2.0.3"
} ]
} ]
}, {
"package" : {
"ecosystem" : "PyPI",
"name" : "tensorflow-cpu"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.1.0"
}, {
"fixed" : "2.1.2"
} ]
} ]
}, {
"package" : {
"ecosystem" : "PyPI",
"name" : "tensorflow-cpu"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.2.0"
}, {
"fixed" : "2.2.1"
} ]
} ],
"versions" : [ "2.2.0" ]
}, {
"package" : {
"ecosystem" : "PyPI",
"name" : "tensorflow-cpu"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.3.0"
}, {
"fixed" : "2.3.1"
} ]
} ],
"versions" : [ "2.3.0" ]
}, {
"package" : {
"ecosystem" : "PyPI",
"name" : "tensorflow-gpu"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.15.4"
} ]
} ]
}, {
"package" : {
"ecosystem" : "PyPI",
"name" : "tensorflow-gpu"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.0.0"
}, {
"fixed" : "2.0.3"
} ]
} ]
}, {
"package" : {
"ecosystem" : "PyPI",
"name" : "tensorflow-gpu"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.1.0"
}, {
"fixed" : "2.1.2"
} ]
} ]
}, {
"package" : {
"ecosystem" : "PyPI",
"name" : "tensorflow-gpu"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.2.0"
}, {
"fixed" : "2.2.1"
} ]
} ],
"versions" : [ "2.2.0" ]
}, {
"package" : {
"ecosystem" : "PyPI",
"name" : "tensorflow-gpu"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.3.0"
}, {
"fixed" : "2.3.1"
} ]
} ],
"versions" : [ "2.3.0" ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/tensorflow/tensorflow/security/advisories/GHSA-cvpc-8phh-8f45"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2020-15211"
}, {
"type" : "WEB",
"url" : "https://github.com/tensorflow/tensorflow/commit/fff2c8326280c07733828f990548979bdc893859"
}, {
"type" : "WEB",
"url" : "https://github.com/tensorflow/tensorflow/commit/f911af101dc0ce0eec17a8740bec9b613ae4195e"
}, {
"type" : "WEB",
"url" : "https://github.com/tensorflow/tensorflow/commit/e6b213cebb56f485bd400961a2ed109aeeac9d3c"
}, {
"type" : "WEB",
"url" : "https://github.com/tensorflow/tensorflow/commit/e47eb1453f35666795a31e208c28922b08756c69"
}, {
"type" : "WEB",
"url" : "https://github.com/tensorflow/tensorflow/commit/e11f55585f614645b360563072ffeb5c3eeff162"
}, {
"type" : "WEB",
"url" : "https://github.com/tensorflow/tensorflow/commit/d8f8236c29744b8e3247c083fd21c9a87180505c"
}, {
"type" : "WEB",
"url" : "https://github.com/tensorflow/tensorflow/commit/cd31fd0ce0449a9e0f83dcad08d6ed7f1d6bef3f"
}, {
"type" : "WEB",
"url" : "https://github.com/tensorflow/tensorflow/commit/c22736982844d19af623ccd7d33e2d199493eee7"
}, {
"type" : "WEB",
"url" : "https://github.com/tensorflow/tensorflow/commit/7e283f97d8c784d3eae5062d9de25d0f432ad239"
}, {
"type" : "WEB",
"url" : "https://github.com/tensorflow/tensorflow/commit/46d5b0852528ddfd614ded79bccc75589f801bd9"
}, {
"type" : "WEB",
"url" : "https://github.com/tensorflow/tensorflow/commit/42ed6ac86856956da65b5957a26fab130ff9471c"
}, {
"type" : "WEB",
"url" : "https://github.com/tensorflow/tensorflow/commit/38cbad757b2e1c0d64b95e4582408fa66627a67c"
}, {
"type" : "WEB",
"url" : "https://github.com/tensorflow/tensorflow/commit/1a8528bfb572884eb8137dab1bf649705c960c47"
}, {
"type" : "WEB",
"url" : "https://github.com/tensorflow/tensorflow/commit/1970c2158b1ffa416d159d03c3370b9a462aee35"
}, {
"type" : "WEB",
"url" : "https://github.com/tensorflow/tensorflow/commit/0b5be2717a19ca7bf505369eb8bdd341405d263d"
}, {
"type" : "WEB",
"url" : "https://github.com/tensorflow/tensorflow/commit/00302787b788c5ff04cb6f62aed5a74d936e86c0"
}, {
"type" : "WEB",
"url" : "https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/kernel_util.cc#L36"
}, {
"type" : "WEB",
"url" : "https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/core/subgraph.cc#L566-L580"
}, {
"type" : "WEB",
"url" : "https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/c/common.h#L82"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/tensorflow/tensorflow"
}, {
"type" : "WEB",
"url" : "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2020-134.yaml"
}, {
"type" : "WEB",
"url" : "https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1"
}, {
"type" : "WEB",
"url" : "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2020-326.yaml"
}, {
"type" : "WEB",
"url" : "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2020-291.yaml"
}, {
"type" : "WEB",
"url" : "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.html"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-125", "CWE-787" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2020-09-25T18:13:16Z",
"nvd_published_at" : "2020-09-25T19:15:00Z"
}
}