CVE-2021-37684 — Vulnetix

CVE-2021-37684 PUBLISHED

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementations of pooling in TFLite are vulnerable to division by 0 errors as there are no checks for divisors not being 0. We have patched the issue in GitHub commit [dfa22b348b70bb89d6d6ec0ff53973bacb4f4695](https://github.com/tensorflow/tensorflow/commit/dfa22b348b70bb89d6d6ec0ff53973bacb4f4695). The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

EPSS 0.01% · 0.8th percentile

Risk Scores

EPSS Score

0.01%

0.8th percentile

Affected Products

Vendor	Product	Versions
Bitnami	tensorflow	2.3.0, 2.4.0, 2.5.0
Bitnami	tensorflow	2.3.0, 2.4.0, 2.5.0

Timeline

Aug 12, 2021 CVE Published
Aug 13, 2021 EPSS Score
Oct 10, 2021 EPSS Score
Dec 7, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Feb 4, 2022 EPSS Score
Apr 1, 2022 EPSS Score
Apr 2, 2022 EPSS Score
May 30, 2022 EPSS Score
Jul 28, 2022 EPSS Score
Sep 24, 2022 EPSS Score
Nov 21, 2022 EPSS Score

References

Open in Interactive Console →