PyPI: tensorflow
CVE-2020-26266
Safety vulnerability ID: SFTY-20201210-55859
Safety legacy ID: pyup.io-39408
TensorFlow versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0 includes a fix for CVE-2020-26266: In affected versions and under certain cases a saved model can trigger use of uninitialized values during code execution. This is caused by having tensor buffers filled with the default value of the type but forgetting to default initialize the quantized floating point types in Eigen.
Overview
Uninitialized memory access in TensorFlow
Advisory
TensorFlow versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0 includes a fix for CVE-2020-26266: In affected versions and under certain cases a saved model can trigger use of uninitialized values during code execution. This is caused by having tensor buffers filled with the default value of the type but forgetting to default initialize the quantized floating point types in Eigen.
Affected Package
Also affects
---
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20201210-55859/CVE-2020-26266
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-qhxx-j73r-qpm2
- https://github.com/tensorflow/tensorflow/commit/ace0c15a22f7f054abcc1f53eabbcb0a1239a9e2
- https://nvd.nist.gov/vuln/detail/CVE-2020-26266
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2020-297.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2020-332.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2020-254.yaml
- https://github.com/advisories/GHSA-qhxx-j73r-qpm2
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more