PyPI: tensorflow-intel
CVE-2022-41908
Safety vulnerability ID: SFTY-20221118-75920
Safety legacy ID: pyup.io-56527
Tensorflow-intel 2.8.4, 2.9.3 and 2.10.1 include a fix for CVE-2022-41908: TensorFlow is an open source platform for machine learning. An input 'token' that is not a UTF-8 bytestring will trigger a 'CHECK' fail in 'tf.raw_ops.PyFunc'. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-mv77-9g28-cwg3
Overview
`CHECK` fail via inputs in `PyFunc`
Advisory
Tensorflow-intel 2.8.4, 2.9.3 and 2.10.1 include a fix for CVE-2022-41908: TensorFlow is an open source platform for machine learning. An input 'token' that is not a UTF-8 bytestring will trigger a 'CHECK' fail in 'tf.raw_ops.PyFunc'. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-mv77-9g28-cwg3
Affected Package
Also affects
---
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20221118-75920/CVE-2022-41908
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-mv77-9g28-cwg3
- https://nvd.nist.gov/vuln/detail/CVE-2022-41908
- https://github.com/tensorflow/tensorflow/commit/9f03a9d3bafe902c1e6beb105b2f24172f238645
- https://github.com/tensorflow/tensorflow/blob/master/tensorflow/python/lib/core/py_func.cc
- https://github.com/advisories/GHSA-mv77-9g28-cwg3
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more