PYSEC-2020-139
Record from OSV · Published October 21, 2020
tensorflow is fixed in 2.4.0 (PyPI)
In Tensorflow before version 2.4.0, when the `boxes` argument of `tf.image.crop_and_resize` has a very large value, the CPU kernel implementation receives it as a C++ `nan` floating point value. Attempting to operate on this is undefined behavior which later produces a segmentation fault. The issue is patched in eccb7ec454e6617738554a255d77f08e60ee0808 and TensorFlow 2.4.0 will be released containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| tensorflow | PyPI | 2.4.0 |
Affected products
| Vendor | Product | Versions |
|---|---|---|
| PyPI | tensorflow | 1.8.0rc1, 2.4.0rc3, 0 |
Timeline
- Oct 21, 2020 CVE Published
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln PYSEC-2020-139
vulnetix vdb fixes PYSEC-2020-139Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/PYSEC-2020-139/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart