VDB
CVE-2021-29617
CVE-2021-29617
PUBLISHED
CVSS 5.5 MEDIUM
TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via `CHECK`-fail in `tf.strings.substr` with invalid arguments. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
EPSS 0.23% · 14.1th percentile
Risk Scores
CVSS 3.1
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score
0.23%
14.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | tensorflow | 0, 2.2.0, 2.3.0 |
| Bitnami | tensorflow | 2.3.0, 2.4.0, 0 |
Timeline
- May 14, 2021 CVE Published
- May 15, 2021 EPSS Score
- May 18, 2021 EPSS Score
- Jul 18, 2021 EPSS Score
- Nov 19, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Jan 19, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Mar 22, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- Jul 25, 2022 EPSS Score
- Sep 25, 2022 EPSS Score
References
- https://github.com/tensorflow/issues/46974 url
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-mmq6-q8r3-48fm url
- https://github.com/tensorflow/issues/46900 url
- https://github.com/tensorflow/tensorflow/commit/890f7164b70354c57d40eda52dcdd7658677c09f url
- https://nvd.nist.gov/vuln/detail/CVE-2021-29617 url