CVE-2021-37667 — Vulnetix

CVE-2021-37667 PUBLISHED

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.UnicodeEncode`. The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/unicode_ops.cc#L533-L539) reads the first dimension of the `input_splits` tensor before validating that this tensor is not empty. We have patched the issue in GitHub commit 2e0ee46f1a47675152d3d865797a18358881d7a6. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

EPSS 0.01% · 2.2th percentile

Risk Scores

EPSS Score

0.01%

2.2th percentile

Affected Products

Vendor	Product	Versions
Bitnami	tensorflow	2.5.0, 2.3.0, 2.4.0
Bitnami	tensorflow	2.3.0, 2.4.0, 2.5.0

Timeline

Aug 12, 2021 CVE Published
Aug 13, 2021 EPSS Score
Oct 10, 2021 EPSS Score
Dec 7, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Feb 3, 2022 EPSS Score
Apr 2, 2022 EPSS Score
May 30, 2022 EPSS Score
Jul 28, 2022 EPSS Score
Sep 24, 2022 EPSS Score
Nov 21, 2022 EPSS Score
Jan 18, 2023 EPSS Score

References

Open in Interactive Console →