VDB
CVE-2021-29613
CVE-2021-29613
PUBLISHED
CVSS 7.099999904632568 HIGH
TensorFlow is an end-to-end open source platform for machine learning. Incomplete validation in `tf.raw_ops.CTCLoss` allows an attacker to trigger an OOB read from heap. The fix will be included in TensorFlow 2.5.0. We will also cherrypick these commits on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
EPSS 0.24% · 15.5th percentile
Risk Scores
CVSS 3.1
7.099999904632568
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
EPSS Score
0.24%
15.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | tensorflow | 0, 2.2.0, 2.3.0 |
| Bitnami | tensorflow | 2.2.0, 2.3.0, 2.4.0 |
Timeline
- May 14, 2021 CVE Published
- May 15, 2021 EPSS Score
- Jul 18, 2021 EPSS Score
- Sep 18, 2021 EPSS Score
- Nov 19, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Mar 22, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 23, 2022 EPSS Score
- Jul 25, 2022 EPSS Score
- Sep 25, 2022 EPSS Score
- Nov 26, 2022 EPSS Score
References
- https://github.com/tensorflow/tensorflow/commit/14607c0707040d775e06b6817325640cb4b5864c url
- https://github.com/tensorflow/tensorflow/commit/4504a081af71514bb1828048363e6540f797005b url
- https://nvd.nist.gov/vuln/detail/CVE-2021-29613 url
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-vvg4-vgrv-xfr7 url