PyPI: tensorflow-macos
CVE-2021-41201
Safety vulnerability ID: SFTY-20211105-07072
Safety legacy ID: pyup.io-58446
Tensorflow-macos versions 2.4.4, 2.5.2 and 2.6.1 include a fix for CVE-2021-41201: In affected versions, during execution, 'EinsumHelper::ParseEquation()' is supposed to set the flags in 'input_has_ellipsis' vector and '*output_has_ellipsis' boolean to indicate whether there is ellipsis in the corresponding inputs and output. However, the code only changes these flags to 'true' and never assigns 'false'. This results in unitialized variable access if callers assume that 'EinsumHelper::ParseEquation()' always sets these flags. The fix is included in TensorFlow 2.7.0. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-j86v-p27c-73fm https://github.com/tensorflow/tensorflow/commit/f09caa532b6e1ac8d2aa61b7832c78c5b79300c6
Overview
Unitialized access in `EinsumHelper::ParseEquation`
Advisory
Tensorflow-macos versions 2.4.4, 2.5.2 and 2.6.1 include a fix for CVE-2021-41201: In affected versions, during execution, 'EinsumHelper::ParseEquation()' is supposed to set the flags in 'input_has_ellipsis' vector and '*output_has_ellipsis' boolean to indicate whether there is ellipsis in the corresponding inputs and output. However, the code only changes these flags to 'true' and never assigns 'false'. This results in unitialized variable access if callers assume that 'EinsumHelper::ParseEquation()' always sets these flags. The fix is included in TensorFlow 2.7.0. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-j86v-p27c-73fm https://github.com/tensorflow/tensorflow/commit/f09caa532b6e1ac8d2aa61b7832c78c5b79300c6
Affected Package
Also affects
---
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20211105-07072/CVE-2021-41201
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-j86v-p27c-73fm
- https://nvd.nist.gov/vuln/detail/CVE-2021-41201
- https://github.com/tensorflow/tensorflow/commit/f09caa532b6e1ac8d2aa61b7832c78c5b79300c6
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-611.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-809.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-394.yaml
- https://github.com/advisories/GHSA-j86v-p27c-73fm
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more