Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-29188 State: PUBLISHED Published: 2022-05-20T23:50:10.000Z Last Updated: 2025-04-23T18:23:32.926Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: stripe Products: smokescreen Problem Types: CWE-918 Description: Smokescreen is an HTTP proxy. The primary use case for Smokescreen is to prevent server-side request forgery (SSRF) attacks in which external attackers leverage the behavior of applications to connect to or scan internal infrastructure. Smokescreen also offers an option to deny access to additional (e.g., external) URLs by way of a deny list. There was an issue in Smokescreen that made it possible to bypass the deny list feature by su
RLs by way of a deny list. There was an issue in Smokescreen that made it possible to bypass the deny list feature by surrounding the hostname with square brackets (e.g. `[example.com]`). This only impacted the HTTP proxy functionality of Smokescreen. HTTPS requests were not impacted. Smokescreen version 0.0.4 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/stripe/smokescreen/security/advisories/GHSA-qwrf-gfpj-qvj6 - https://github.com/stripe/smokescreen/commit/dea7b3c89df000f4072ff9866d61d78e30df6a36
CVE ID: CVE-2022-29189 State: PUBLISHED Published: 2022-05-20T23:55:16.000Z Last Updated: 2025-04-23T18:23:18.694Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: pion Products: dtls Problem Types: CWE-120 Description: Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, a buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or timed out. An attacker could exploit this to cause excessive memory usage. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available. Additional
ory usage. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pion/dtls/releases/tag/v2.1.4 - https://github.com/pion/dtls/security/advisories/GHSA-cx94-mrg9-rq4j - https://github.com/pion/dtls/commit/a6397ff7282bc56dc37a68ea9211702edb4de1de
CVE ID: CVE-2022-29190 State: PUBLISHED Published: 2022-05-20T23:55:10.000Z Last Updated: 2025-04-23T18:23:25.844Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: pion Products: dtls Problem Types: CWE-835 Description: Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, an attacker can send packets that sends Pion DTLS into an infinite loop when processing. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pion/dtls/security/advisories/GHSA-cm8f-h6j3-p25c - https
ner: - CISA ADP Vulnrichment: References: - https://github.com/pion/dtls/security/advisories/GHSA-cm8f-h6j3-p25c - https://github.com/pion/dtls/commit/e0b2ce3592e8e7d73713ac67b363a2e192a4cecf - https://github.com/pion/dtls/releases/tag/v2.1.4
CVE ID: CVE-2022-29191 State: PUBLISHED Published: 2022-05-20T20:50:11.000Z Last Updated: 2025-04-22T18:00:23.414Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-20 Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.GetSessionTensor` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vuln
8.1, 2.7.2, and 2.6.4 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4 - https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2 - https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1 - https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0 - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-fv25-wrff-wf86 - https://github.com/tensorflow/tensorflow/commit/48305e8ffe5246d67570b64096a96f8e315a7281 - https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/session_ops.cc#L94-
thub.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/session_ops.cc#L94-L112
CVE ID: CVE-2022-29192 State: PUBLISHED Published: 2022-05-20T20:30:14.000Z Last Updated: 2025-04-22T18:00:33.691Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-20 Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.QuantizeAndDequantizeV4Grad` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CI
s 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-h2wq-prv9-2f56 - https://github.com/tensorflow/tensorflow/commit/098e7762d909bac47ce1dbabe6dfd06294cb9d58 - https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/quantize_and_dequantize_op.cc#L148-L226 - https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4 - https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2 - https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1 - https://github.com/tensorflow
rflow/releases/tag/v2.7.2 - https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1 - https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0
CVE ID: CVE-2022-29193 State: PUBLISHED Published: 2022-05-20T21:20:14.000Z Last Updated: 2025-04-22T17:59:57.988Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-20 Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.TensorSummaryV2` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnr
.1, 2.7.2, and 2.6.4 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4 - https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2 - https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1 - https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0 - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-2p9q-h29j-3f5v - https://github.com/tensorflow/tensorflow/commit/290bb05c80c327ed74fae1d089f1001b1e2a4ef7 - https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/summary_tensor_op.cc
hub.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/summary_tensor_op.cc#L33-L58
CVE ID: CVE-2022-29194 State: PUBLISHED Published: 2022-05-20T21:10:12.000Z Last Updated: 2025-04-22T18:00:13.737Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-20 Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.DeleteSessionTensor` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP V
2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4 - https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2 - https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1 - https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0 - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-h5g4-ppwx-48q2 - https://github.com/tensorflow/tensorflow/commit/cff267650c6a1b266e4b4500f69fbc49cdd773c5 - https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/session_ops.cc#L
/github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/session_ops.cc#L128-L144
CVE ID: CVE-2022-29195 State: PUBLISHED Published: 2022-05-20T22:00:15.000Z Last Updated: 2025-04-22T17:58:58.035Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-20 Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.StagePeek` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `index` is a scalar but there is no validation for this before accessing its value. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 cont
is a scalar but there is no validation for this before accessing its value. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4 - https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2 - https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1 - https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0 - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-h48f-q7rw-hvr7 - https://github.com/tensorflow/tensorflow/commit/cebe3c45d76357d201c65bdbbf0dbe6e8a63bbdb - https://github.com/tensorflow/tensor
/github.com/tensorflow/tensorflow/commit/cebe3c45d76357d201c65bdbbf0dbe6e8a63bbdb - https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/stage_op.cc#L26
CVE ID: CVE-2022-29196 State: PUBLISHED Published: 2022-05-20T21:55:12.000Z Last Updated: 2025-04-22T17:59:18.399Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-20 Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.Conv3DBackpropFilterV2` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code does not validate that the `filter_sizes` argument is a vector. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for
s not validate that the `filter_sizes` argument is a vector. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4 - https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2 - https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1 - https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0 - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-5v77-j66x-4c4g - https://github.com/tensorflow/tensorflow/commit/174c5096f303d5be7ed2ca2662b08371bff4ab88 - https://github.com/tensorflow/tensorflow/blob/f3b9b
sorflow/tensorflow/commit/174c5096f303d5be7ed2ca2662b08371bff4ab88 - https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/conv_grad_ops_3d.cc
CVE ID: CVE-2022-29197 State: PUBLISHED Published: 2022-05-20T21:55:18.000Z Last Updated: 2025-04-22T17:59:07.613Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-20 Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.UnsortedSegmentJoin` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `num_segments` is a scalar but there is no validation for this before accessing its value. Versions 2.9.0, 2.8.1, 2.7.
s `num_segments` is a scalar but there is no validation for this before accessing its value. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4 - https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2 - https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1 - https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0 - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-hrg5-737c-2p56 - https://github.com/tensorflow/tensorflow/commit/13d38a07ce9143e044aa737cfd7bb759d0e9b400 - https://github.com/
7c-2p56 - https://github.com/tensorflow/tensorflow/commit/13d38a07ce9143e044aa737cfd7bb759d0e9b400 - https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/unsorted_segment_join_op.cc#L92-L95
CVE ID: CVE-2022-29198 State: PUBLISHED Published: 2022-05-20T21:50:12.000Z Last Updated: 2025-04-22T17:59:29.034Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-20 Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.SparseTensorToCSRSparseMatrix` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `dense_shape` is a vector and `indices` is a matrix (as part of requirements for sparse tensors) but there i
ode assumes `dense_shape` is a vector and `indices` is a matrix (as part of requirements for sparse tensors) but there is no validation for this. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4 - https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2 - https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1 - https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0 - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-mg66-qvc5-rm93 - https://github.com/tensorflow/tensorflow/commit/ea50a40e8
ensorflow/tensorflow/security/advisories/GHSA-mg66-qvc5-rm93 - https://github.com/tensorflow/tensorflow/commit/ea50a40e84f6bff15a0912728e35b657548cef11 - https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/sparse/sparse_tensor_to_csr_sparse_matrix_op.cc#L65-L119
CVE ID: CVE-2022-29199 State: PUBLISHED Published: 2022-05-20T21:40:12.000Z Last Updated: 2025-04-22T17:59:37.834Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-20 Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.LoadAndRemapMatrix does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `initializing_values` is a vector but there is no validation for this before accessing its value. Versions 2.9.0, 2.8.1,
`initializing_values` is a vector but there is no validation for this before accessing its value. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4 - https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2 - https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1 - https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0 - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-p9rc-rmr5-529j - https://github.com/tensorflow/tensorflow/commit/3150642acbbe254e3c3c5d2232143fa591855ac9 - https://github
rc-rmr5-529j - https://github.com/tensorflow/tensorflow/commit/3150642acbbe254e3c3c5d2232143fa591855ac9 - https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/load_and_remap_matrix_op.cc#L70-L98
CVE ID: CVE-2022-29200 State: PUBLISHED Published: 2022-05-20T21:30:14.000Z Last Updated: 2025-04-22T17:59:47.129Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-20 Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.LSTMBlockCell` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code does not validate the ranks of any of the arguments to this API call. This results in `CHECK`-failures when the elements of the tens
idate the ranks of any of the arguments to this API call. This results in `CHECK`-failures when the elements of the tensor are accessed. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4 - https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2 - https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1 - https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0 - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-2vv3-56qg-g2cf - https://github.com/tensorflow/tensorflow/commit/803404044ae7a1efac
/tensorflow/security/advisories/GHSA-2vv3-56qg-g2cf - https://github.com/tensorflow/tensorflow/commit/803404044ae7a1efac48ba82d74111fce1ddb09a - https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/rnn/lstm_ops.cc
CVE ID: CVE-2022-29201 State: PUBLISHED Published: 2022-05-20T23:00:15.000Z Last Updated: 2025-04-22T17:57:35.065Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-20, CWE-476 Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.QuantizedConv2D` does not fully validate the input arguments. In this case, references get bound to `nullptr` for each argument that is empty. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnri
1, 2.7.2, and 2.6.4 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4 - https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2 - https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1 - https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0 - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-pqhm-4wvf-2jg8 - https://github.com/tensorflow/tensorflow/commit/0f0b080ecde4d3dfec158d6f60da34d5e31693c4 - https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/quantized_conv_ops.cc
CVE ID: CVE-2022-29202 State: PUBLISHED Published: 2022-05-20T22:55:13.000Z Last Updated: 2025-04-22T17:57:48.764Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-20, CWE-400 Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.ragged.constant` does not fully validate the input arguments. This results in a denial of service by consuming all available memory. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References
4 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4 - https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2 - https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1 - https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0 - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-cwpm-f78v-7m5c - https://github.com/tensorflow/tensorflow/issues/55199 - https://github.com/tensorflow/tensorflow/commit/bd4d5583ff9c8df26d47a23e508208844297310e - https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorf
d47a23e508208844297310e - https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/python/ops/ragged/ragged_factory_ops.py#L146-L239
CVE ID: CVE-2022-29203 State: PUBLISHED Published: 2022-05-20T22:50:11.000Z Last Updated: 2025-04-22T17:58:03.254Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-190 Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.SpaceToBatchND` (in all backends such as XLA and handwritten kernels) is vulnerable to an integer overflow: The result of this integer overflow is used to allocate the output tensor, hence we get a denial of service via a `CHECK`-failure (assertion failure), as in TFSA-2021-198. Versions 2.
put tensor, hence we get a denial of service via a `CHECK`-failure (assertion failure), as in TFSA-2021-198. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-198.md - https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4 - https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2 - https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1 - https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0 - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-jjm6-4vf7-
tensorflow/tensorflow/releases/tag/v2.9.0 - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-jjm6-4vf7-cjh4 - https://github.com/tensorflow/tensorflow/commit/acd56b8bcb72b163c834ae4f18469047b001fadf