Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-29501 State: PUBLISHED Published: 2021-05-10T16:30:11 Last Updated: 2024-08-03T22:11:05.880Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Dav-Git Products: Dav-Cogs Problem Types: CWE-74 Description: Ticketer is a command based ticket system cog (plugin) for the red discord bot. A vulnerability allowing discord users to expose sensitive information has been found in the Ticketer cog. Please upgrade to version 1.0.1 as soon as possible. As a workaround users may unload the ticketer cog to disable the exploitable code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Dav-Git/Dav-Cogs/security/advisories/GHSA
ional Analyst Notes: - CVE Program Container: References: - https://github.com/Dav-Git/Dav-Cogs/security/advisories/GHSA-r2cf-49r7-pfj7 - https://github.com/Dav-Git/Dav-Cogs/commit/3d54ef9b52ce03f139b7d6c1cc38c375e65593fd
CVE ID: CVE-2021-29502 State: PUBLISHED Published: 2021-05-10T17:20:10 Last Updated: 2024-08-03T22:11:05.409Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: retke Products: Laggrons-Dumb-Cogs Problem Types: CWE-74 Description: WarnSystem is a cog (plugin) for the Red discord bot. A vulnerability has been found in the code that allows any user to access sensible informations by setting up a specific template which is not properly sanitized. The problem has been patched in version 1.3.18. Users should update and type `!warnsysteminfo` to check that their version is 1.3.18 or above. As a workaround users may unload the WarnSystem cog or disable the `!warnset des
that their version is 1.3.18 or above. As a workaround users may unload the WarnSystem cog or disable the `!warnset description` command globally. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/retke/Laggrons-Dumb-Cogs/security/advisories/GHSA-834g-67vv-m9wq - https://github.com/retke/Laggrons-Dumb-Cogs/commit/c79dd2cc879989cf2018e76ba2aad0baef3b4ec8
CVE ID: CVE-2021-29503 State: PUBLISHED Published: 2021-05-19T19:55:10 Last Updated: 2024-08-03T22:11:05.313Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: hedgedoc Products: hedgedoc Problem Types: CWE-80 Description: HedgeDoc is a platform to write and share markdown. HedgeDoc before version 1.8.2 is vulnerable to a cross-site scripting attack using the YAML-metadata of a note. An attacker with write access to a note can embed HTML tags in the Open Graph metadata section of the note, resulting in the frontend rendering the script tag as part of the `<head>` section. Unless your instance prevents guests from editing notes, this vulnerability allows unauthen
art of the `<head>` section. Unless your instance prevents guests from editing notes, this vulnerability allows unauthenticated attackers to inject JavaScript into notes that allow guest edits. If your instance prevents guests from editing notes, this vulnerability allows authenticated attackers to inject JavaScript into any note pages they have write-access to. This vulnerability is patched in version 1.8.2. As a workaround, one can disable guest edits until the next update. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-gjg7-4j2h-94fq - https://github.com/hedgedoc/hedgedoc/commit/01dad5821ee28377ebe640c6c72c3e0
oc/security/advisories/GHSA-gjg7-4j2h-94fq - https://github.com/hedgedoc/hedgedoc/commit/01dad5821ee28377ebe640c6c72c3e0bb0d51ea7 - https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
CVE ID: CVE-2021-29504 State: PUBLISHED Published: 2021-06-07T20:50:17 Last Updated: 2024-08-03T22:11:05.507Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: wp-cli Products: wp-cli Problem Types: CWE-295 Description: WP-CLI is the command-line interface for WordPress. An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-CLI side, gaining full control over the communication content, including the ability to impersonate update servers and push malicious updates towards WordPress instances controlled by the
ding the ability to impersonate update servers and push malicious updates towards WordPress instances controlled by the vulnerable WP-CLI agent, or push malicious updates toward WP-CLI itself. The vulnerability stems from the fact that the default behavior of `WP_CLI\Utils\http_request()` when encountering a TLS handshake error is to disable certificate validation and retry the same request. The default behavior has been changed with version 2.5.0 of WP-CLI and the `wp-cli/wp-cli` framework (via https://github.com/wp-cli/wp-cli/pull/5523) so that the `WP_CLI\Utils\http_request()` method accepts an `$insecure` option that is `false` by default and consequently that a TLS handshake failure is
est()` method accepts an `$insecure` option that is `false` by default and consequently that a TLS handshake failure is a hard error by default. This new default is a breaking change and ripples through to all consumers of `WP_CLI\Utils\http_request()`, including those in separate WP-CLI bundled or third-party packages. https://github.com/wp-cli/wp-cli/pull/5523 has also added an `--insecure` flag to the `cli update` command to counter this breaking change. There is no direct workaround for the default insecure behavior of `wp-cli/wp-cli` versions before 2.5.0. The workaround for dealing with the breaking change in the commands directly affected by the new secure default behavior is to add t
nd for dealing with the breaking change in the commands directly affected by the new secure default behavior is to add the `--insecure` flag to manually opt-in to the previous insecure behavior. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wp-cli/wp-cli/security/advisories/GHSA-rwgm-f83r-v3qj - https://github.com/wp-cli/checksum-command/pull/86 - https://github.com/wp-cli/config-command/pull/128 - https://github.com/wp-cli/core-command/pull/186 - https://github.com/wp-cli/extension-command/pull/287 - https://github.com/wp-cli/package-command/pull/138 - https://github.com/wp-cli/wp-cli/pull/5523
CVE ID: CVE-2021-29505 State: PUBLISHED Published: 2021-05-28T21:00:19 Last Updated: 2025-05-29T23:30:31.977Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: x-stream Products: xstream Problem Types: CWE-94, CWE-502 Description: XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in versio
ity framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/x-stream/xstream/security/advisories/GHSA-7chv-rrw6-w6fc - https://github.com/x-stream/xstream/commit/24fac82191292c6ae25f94508d28b9823f83624f - https://github.com/x-stream/xstream/commit/f0c4a8d861b68ffc3119cfbbbd632deee624e227 - https://lists.apache.org/thread.html/r8ee51debf7fd184b6a6b020dc31df25118b0aa612885f12fbe77f04f@%3Cdev.jmeter.apache.org%3E - https://lists.debian.org/debian-lts-announce/2021/07/msg00004.html - https://lists.fedoraproject.org/archives/list/package-announc
sts.debian.org/debian-lts-announce/2021/07/msg00004.html - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB - https://security.netapp.com/advisory/ntap-20210708-0007 - https://www.debian.org/security/2021/dsa-5004 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security
curity-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpujul2022.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://x-stream.github.io/CVE-2021-29505.html
CVE ID: CVE-2021-29506 State: PUBLISHED Published: 2021-05-13T18:15:13 Last Updated: 2024-08-03T22:11:05.271Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: graphhopper Products: graphhopper Problem Types: CWE-400 Description: GraphHopper is an open-source Java routing engine. In GrassHopper from version 2.0 and before version 2.4, there is a regular expression injection vulnerability that may lead to Denial of Service. This has been patched in 2.4 and 3.0 See this pull request for the fix: https://github.com/graphhopper/graphhopper/pull/2304 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/graphhopper/graphhopper/security
304 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/graphhopper/graphhopper/security/advisories/GHSA-hf44-3mx6-vhhw - https://github.com/graphhopper/graphhopper/pull/2304 - https://github.com/graphhopper/graphhopper/commit/eb189be1fa7443ebf4ae881e737a18f818c95f41
CVE ID: CVE-2021-29507 State: PUBLISHED Published: 2021-05-28T21:00:16 Last Updated: 2024-08-03T22:11:05.507Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: GENIVI Products: dlt-daemon Problem Types: CWE-20 Description: GENIVI Diagnostic Log and Trace (DLT) provides a log and trace interface. In versions of GENIVI DLT between 2.10.0 and 2.18.6, a configuration file containing the special characters could cause a vulnerable component to crash. All the applications which are using the configuration file could fail to generate their dlt logs in system. As of time of publication, no patch exists. As a workaround, one may check the integrity of information in co
in system. As of time of publication, no patch exists. As a workaround, one may check the integrity of information in configuration file manually. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GENIVI/dlt-daemon/security/advisories/GHSA-7cqp-2hqj-mh3f
CVE ID: CVE-2021-29508 State: PUBLISHED Published: 2021-05-11T16:35:10 Last Updated: 2024-08-03T22:11:05.408Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: AsynkronIT Products: Wire Problem Types: CWE-502 Description: Due to how Wire handles type information in its serialization format, malicious payloads can be passed to a deserializer. e.g. using a surrogate on the sender end, an attacker can pass information about a different type for the receiving end. And by doing so allowing the serializer to create any type on the deserializing end. This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quali
nd. This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300?view=vs-2019. This also applies to the fork of Wire. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AsynkronIT/Wire/security/advisories/GHSA-hpw7-3vq3-mmv6 - https://www.nuget.org/packages/Wire/
CVE ID: CVE-2021-29509 State: PUBLISHED Published: 2021-05-11T16:50:11 Last Updated: 2024-08-03T22:11:05.438Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: puma Products: puma Problem Types: CWE-400 Description: Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster. A `puma` server
till be starved by greedy persistent-connections saturating all threads in all processes in the cluster. A `puma` server which received more concurrent `keep-alive` connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections. This problem has been fixed in `puma` 4.3.8 and 5.3.1. Setting `queue_requests false` also fixes the issue. This is not advised when using `puma` without a reverse proxy, such as `nginx` or `apache`, because you will open yourself to slow client attacks (e.g. slowloris). The fix is very small and a git patch is available for those using unsupported versions of Puma. Additional Analyst
s). The fix is very small and a git patch is available for those using unsupported versions of Puma. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/puma/puma/security/advisories/GHSA-q28m-8xjw-8vr5 - https://gist.github.com/nateberkopec/4b3ea5676c0d70cbb37c82d54be25837 - https://github.com/puma/puma/security/policy - https://rubygems.org/gems/puma - https://security.gentoo.org/glsa/202208-28 - https://lists.debian.org/debian-lts-announce/2022/08/msg00015.html
CVE ID: CVE-2021-29510 State: PUBLISHED Published: 2021-05-13T18:55:11 Last Updated: 2024-08-03T22:11:05.442Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: samuelcolvin Products: pydantic Problem Types: CWE-835 Description: Pydantic is a data validation and settings management using Python type hinting. In affected versions passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pyd
in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed versio
s you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/samuelcolvin/pydantic/security/advisories/GHSA-5jqp-qgf6-3pvh - https://github.com/samuelcolvin/pydantic/commit/7e83fdd2563ffac081db7ecdf1affa65ef38c468 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UMKAJX4O6IGBBCE32CO2G7PZQCCQSBLV/ - https://lists.fedora
rchives/list/package-announce%40lists.fedoraproject.org/message/UMKAJX4O6IGBBCE32CO2G7PZQCCQSBLV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S2HT266L6Q7H6ICP7DFGXOGBJHNNKMKB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEFWM7DYKD2ZHE7R5YT5EQWJPV4ZKYRB/
CVE ID: CVE-2021-29511 State: PUBLISHED Published: 2021-05-12T17:15:11 Last Updated: 2024-08-03T22:11:05.441Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: rust-blockchain Products: evm Problem Types: CWE-770 Description: evm is a pure Rust implementation of Ethereum Virtual Machine. Prior to the patch, when executing specific EVM opcodes related to memory operations that use `evm_core::Memory::copy_large`, the `evm` crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack. The flaw was corrected in commit `19ade85`. Users should upgrade to `==0.21.1, ==0.23.1, ==0.24.1, ==0.25.1, >=0.26.1
k. The flaw was corrected in commit `19ade85`. Users should upgrade to `==0.21.1, ==0.23.1, ==0.24.1, ==0.25.1, >=0.26.1`. There are no workarounds. Please upgrade your `evm` crate version. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rust-blockchain/evm/security/advisories/GHSA-4jwq-572w-4388 - https://github.com/rust-blockchain/evm/commit/19ade858c430ab13eb562764a870ac9f8506f8dd - https://crates.io/crates/evm
CVE ID: CVE-2021-29512 State: PUBLISHED Published: 2021-05-14T18:55:10 Last Updated: 2024-08-03T22:11:05.767Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: tensorflow Products: tensorflow Problem Types: CWE-120 Description: TensorFlow is an end-to-end open source platform for machine learning. If the `splits` argument of `RaggedBincount` does not specify a valid `SparseTensor`(https://www.tensorflow.org/api_docs/python/tf/sparse/SparseTensor), then an attacker can trigger a heap buffer overflow. This will cause a read from outside the bounds of the `splits` tensor buffer in the implementation of the `RaggedBincount` op(https://github.com/tensorflow/tensorflow
of the `splits` tensor buffer in the implementation of the `RaggedBincount` op(https://github.com/tensorflow/tensorflow/blob/8b677d79167799f71c42fd3fa074476e0295413a/tensorflow/core/kernels/bincount_op.cc#L430-L433). Before the `for` loop, `batch_idx` is set to 0. The user controls the `splits` array, making it contain only one element, 0. Thus, the code in the `while` loop would increment `batch_idx` and then try to read `splits(1)`, which is outside of bounds. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 and TensorFlow 2.3.3, as these are also affected. Additional Analyst Notes: - CVE Program Container: References: - https://github.
Flow 2.3.3, as these are also affected. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-4278-2v5v-65r4 - https://github.com/tensorflow/tensorflow/commit/eebb96c2830d48597d055d247c0e9aebaea94cd5
CVE ID: CVE-2021-29513 State: PUBLISHED Published: 2021-05-14T19:36:30 Last Updated: 2024-08-03T22:11:05.380Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: tensorflow Products: tensorflow Problem Types: CWE-476 Description: TensorFlow is an end-to-end open source platform for machine learning. Calling TF operations with tensors of non-numeric types when the operations expect numeric tensors result in null pointer dereferences. The conversion from Python array to C++ array(https://github.com/tensorflow/tensorflow/blob/ff70c47a396ef1e3cb73c90513da4f5cb71bebba/tensorflow/python/lib/core/ndarray_tensor.cc#L113-L169) is vulnerable to a type confusion. The fix will
13da4f5cb71bebba/tensorflow/python/lib/core/ndarray_tensor.cc#L113-L169) is vulnerable to a type confusion. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-452g-f7fp-9jf7 - https://github.com/tensorflow/tensorflow/commit/030af767d357d1b4088c4a25c72cb3906abac489
CVE ID: CVE-2021-29514 State: PUBLISHED Published: 2021-05-14T19:36:25 Last Updated: 2024-08-03T22:11:05.431Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: tensorflow Products: tensorflow Problem Types: CWE-787 Description: TensorFlow is an end-to-end open source platform for machine learning. If the `splits` argument of `RaggedBincount` does not specify a valid `SparseTensor`(https://www.tensorflow.org/api_docs/python/tf/sparse/SparseTensor), then an attacker can trigger a heap buffer overflow. This will cause a read from outside the bounds of the `splits` tensor buffer in the implementation of the `RaggedBincount` op(https://github.com/tensorflow/tensorflow
of the `splits` tensor buffer in the implementation of the `RaggedBincount` op(https://github.com/tensorflow/tensorflow/blob/8b677d79167799f71c42fd3fa074476e0295413a/tensorflow/core/kernels/bincount_op.cc#L430-L446). Before the `for` loop, `batch_idx` is set to 0. The attacker sets `splits(0)` to be 7, hence the `while` loop does not execute and `batch_idx` remains 0. This then results in writing to `out(-1, bin)`, which is before the heap allocated buffer for the output tensor. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 and TensorFlow 2.3.3, as these are also affected. Additional Analyst Notes: - CVE Program Container: References:
2.4.2 and TensorFlow 2.3.3, as these are also affected. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/commit/eebb96c2830d48597d055d247c0e9aebaea94cd5 - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-8h46-5m9h-7553
CVE ID: CVE-2021-29515 State: PUBLISHED Published: 2021-05-14T19:36:20 Last Updated: 2024-08-03T22:11:05.742Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: tensorflow Products: tensorflow Problem Types: CWE-476 Description: TensorFlow is an end-to-end open source platform for machine learning. The implementation of `MatrixDiag*` operations(https://github.com/tensorflow/tensorflow/blob/4c4f420e68f1cfaf8f4b6e8e3eb857e9e4c3ff33/tensorflow/core/kernels/linalg/matrix_diag_op.cc#L195-L197) does not validate that the tensor arguments are non-empty. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3
The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-hc6c-75p4-hmq4 - https://github.com/tensorflow/tensorflow/commit/a7116dd3913c4a4afd2a3a938573aa7c785fdfc6
CVE ID: CVE-2021-29516 State: PUBLISHED Published: 2021-05-14T19:36:16 Last Updated: 2024-08-03T22:11:05.513Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: tensorflow Products: tensorflow Problem Types: CWE-476 Description: TensorFlow is an end-to-end open source platform for machine learning. Calling `tf.raw_ops.RaggedTensorToVariant` with arguments specifying an invalid ragged tensor results in a null pointer dereference. The implementation of `RaggedTensorToVariant` operations(https://github.com/tensorflow/tensorflow/blob/904b3926ed1c6c70380d5313d282d248a776baa1/tensorflow/core/kernels/ragged_tensor_to_variant_op.cc#L39-L40) does not validate that the ragg
380d5313d282d248a776baa1/tensorflow/core/kernels/ragged_tensor_to_variant_op.cc#L39-L40) does not validate that the ragged tensor argument is non-empty. Since `batched_ragged` contains no elements, `batched_ragged.splits` is a null vector, thus `batched_ragged.splits(0)` will result in dereferencing `nullptr`. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-84mw-34w6-2q43 - https://github.com/tens