TQRG/raw-osv-data huggingface dataset:
Vulnerability: PYSEC-2021-553
Aliases: GHSA-95xm-g58g-3p88, CVE-2021-37640
Published: 2021-08-12T18:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.SparseReshape` can be made to trigger an integral division by 0 exception. The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/reshape_util.cc#L176-L181) calls the reshaping functor whenever there is at least an index in the input but does not check that shape of the input or the target shape have both a non-zero number of elements. The [reshape functor](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/reshape_util.cc#L40-L78) blindly divides by the dimensions of the target shape. Hence, if this is not checked, code will result in a division by 0. We have patched the issue in GitHub commit 4923de56ec94fff7770df259ab7f2288a74feb41. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1 as this is the other affected version.
Vulnerability: PYSEC-2014-52
Aliases: CVE-2013-4188
Published: 2014-03-11T19:37:00Z

traverser.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers with administrator privileges to cause a denial of service (infinite loop and resource consumption) via unspecified vectors related to "retrieving information for certain resources."
Vulnerability: PYSEC-2021-103
Aliases: CVE-2021-32681, GHSA-xfrw-hxr5-ghqf
Published: 2021-06-17T17:15:00Z

Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, versions 2.12-2.12.4, and versions prior to 2.11.8. When the `{% include_block %}` template tag is used to output the value of a plain-text StreamField block (`CharBlock`, `TextBlock` or a similar user-defined block derived from `FieldBlock`), and that block does not specify a template for rendering, the tag output is not properly escaped as HTML. This could allow users to insert arbitrary HTML or scripting. This vulnerability is only exploitable by users with the ability to author StreamField content (i.e. users with 'editor' access to the Wagtail admin). Patched versions have been released as Wagtail 2.11.8 (for the LTS 2.11 branch), Wagtail 2.12.5, and Wagtail 2.13.2 (for the current 2.13 branch). As a workaround, site implementors who are unable to upgrade to a current supported version should audit their use of `{% include_block %}` to ensure it is not used to output `CharBlock` / `TextBlock` values with no associated template. Note that this only applies where `{% include_block %}` is used directly on that block (uses of `include_block` on a block _containing_ a CharBlock / TextBlock, such as a StructBlock, are unaffected). In these cases, the tag can be replaced with Django's `{{ ... }}` syntax - e.g. `{% include_block my_title_block %}` becomes `{{ my_title_block }}`.
Vulnerability: PYSEC-2018-71
Aliases: CVE-2017-1000482
Published: 2018-01-03T18:29:00Z

A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this executed when a visitor click the home page link on the author page.
Vulnerability: GHSA-3w67-q784-6w7c
Summary: Division by zero in TFLite's implementation of `GatherNd`
Aliases: CVE-2021-29589
Severity: LOW
CWE: CWE-369
Published: 2021-05-21T14:26:51Z

### Impact
The reference implementation of the `GatherNd` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/0d45ea1ca641b21b73bcf9c00e0179cda284e7e7/tensorflow/lite/kernels/internal/reference/reference_ops.h#L966):

```cc 
ret.dims_to_count[i] = remain_flat_size / params_shape.Dims(i);
```

An attacker can craft a model such that `params` input would be an empty tensor. In turn, `params_shape.Dims(.)` would be zero, in at least one dimension.

### Patches
We have patched the issue in GitHub commit [8e45822aa0b9f5df4b4c64f221e64dc930a70a9d](https://github.com/tensorflow/tensorflow/commit/8e45822aa0b9f5df4b4c64f221e64dc930a70a9d).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions. 

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: PYSEC-2021-800
Aliases: GHSA-wf5p-c75w-w3wh, CVE-2021-37689
Published: 2021-08-12T22:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service. This is caused by the MLIR optimization of `L2NormalizeReduceAxis` operator. The [implementation](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/compiler/mlir/lite/transforms/optimize.cc#L67-L70) unconditionally dereferences a pointer to an iterator to a vector without checking that the vector has elements. We have patched the issue in GitHub commit d6b57f461b39fd1aa8c1b870f1b974aac3554955. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Vulnerability: GHSA-cf4q-4cqr-7g7w
Summary: SVG with embedded scripts can lead to cross-site scripting attacks in xml2rfc
Severity: MODERATE
CWE: CWE-79
Published: 2022-04-22T20:25:53Z

xml2rfc allows `script` elements in SVG sources.
In HTML output having these script elements can lead to XSS attacks.

Sample XML snippet:
```
<artwork type="svg" src="data:image/svg+xml,%3Csvg viewBox='0 0 10 10' xmlns='http://www.w3.org/2000/svg'%3E%3Cscript%3E window.alert('Test Alert'); %3C/script%3E%3C/svg%3E">
</artwork>
```

### Impact
This vulnerability impacts website that publish HTML drafts and RFCs.

### Patches
This has been fixed in version [3.12.4](https://github.com/ietf-tools/xml2rfc/releases/tag/v3.12.4).

### Workarounds
If SVG source is self-contained within the XML, scraping `script` elements from SVG files.

### References
* https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [xml2rfc](https://github.com/ietf-tools/xml2rfc/)
* Email us at [operational-vulnerability@ietf.org](mailto:operational-vulnerability@ietf.org)
* [Infrastructure and Services Vulnerability Disclosure](https://www.ietf.org/about/administration/policies-procedures/vulnerability-disclosure/)
Vulnerability: PYSEC-2010-11
Aliases: CVE-2010-3494
Published: 2010-10-19T20:00:00Z

Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.2 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, a related issue to CVE-2010-3492.
Vulnerability: PYSEC-2020-103
Aliases: CVE-2020-11652
Published: 2020-04-30T17:15:00Z

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
Vulnerability: PYSEC-2020-18
Aliases: GHSA-hhx9-p69v-cx2j, CVE-2020-13927
Published: 2020-11-10T16:15:00Z

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default
Vulnerability: PYSEC-2022-25
Aliases: GHSA-fh56-85cw-5pq6, CVE-2021-45958
Published: 2022-01-01T00:15:00Z

UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Exploitation can, for example, use a large amount of indentation.
Vulnerability: PYSEC-2019-145
Aliases: CVE-2019-10206
Published: 2019-11-22T13:15:00Z

ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them.
Vulnerability: PYSEC-2021-416
Aliases: GHSA-rg3m-hqc5-344v, CVE-2021-41224
Published: 2021-11-05T21:15:00Z

TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SparseFillEmptyRows` can be made to trigger a heap OOB access. This occurs whenever the size of `indices` does not match the size of `values`. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Vulnerability: GHSA-cmwx-9m2h-x7v4
Summary: Ansible apt_key module does not properly verify key fingerprint
Aliases: CVE-2016-8614
Severity: HIGH
CWE: CWE-358
Published: 2018-10-10T17:23:26Z

A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.
Vulnerability: GHSA-x345-32rc-8h85
Summary: Denial of service attack via push rule patterns in matrix-synapse
Aliases: CVE-2021-29471
Severity: LOW
CWE: CWE-400, CWE-331
Published: 2021-05-13T20:22:51Z

### Impact

"Push rules" can specify [conditions](https://matrix.org/docs/spec/client_server/r0.6.1#conditions) under which they will match, including `event_match`, which matches event content against a pattern including wildcards.

Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events.

### Patches

The issue is patched by https://github.com/matrix-org/synapse/commit/03318a766cac9f8b053db2214d9c332a977d226c.

### Workarounds

A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy.

### For more information

If you have any questions or comments about this advisory, email us at security@matrix.org.
Vulnerability: PYSEC-2017-49
Aliases: CVE-2015-3206
Published: 2017-08-25T18:29:00Z

The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service (bad response), or have other unspecified impact by performing a man-in-the-middle attack.
Vulnerability: GHSA-g8wg-cjwc-xhhp
Summary: Heap OOB in nested `tf.map_fn` with `RaggedTensor`s
Aliases: CVE-2021-37679
Severity: HIGH
CWE: CWE-125, CWE-681
Published: 2021-08-25T14:41:00Z

### Impact
It is possible to nest a `tf.map_fn` within another `tf.map_fn` call. However, if the input tensor is a `RaggedTensor` and there is no function signature provided, code assumes the output is a fully specified tensor and fills output buffer with uninitialized contents from the heap:

```python
import tensorflow as tf
x = tf.ragged.constant([[1,2,3], [4,5], [6]])
t = tf.map_fn(lambda r: tf.map_fn(lambda y: r, r), x)
z = tf.ragged.constant([[[1,2,3],[1,2,3],[1,2,3]],[[4,5],[4,5]],[[6]]])
```
  
The `t` and `z` outputs should be identical, however this is not the case. The last row of `t` contains data from the heap which can be used to leak other memory information.

The bug lies in the conversion from a `Variant` tensor to a `RaggedTensor`. The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/ragged_tensor_from_variant_op.cc#L177-L190) does not check that all inner shapes match and this results in the additional dimensions in the above example.

The same implementation can result in data loss, if input tensor is tweaked:

```python
import tensorflow as tf
x = tf.ragged.constant([[1,2], [3,4,5], [6]])
t = tf.map_fn(lambda r: tf.map_fn(lambda y: r, r), x) 
```

Here, the output tensor will only have 2 elements for each inner dimension.

### Patches
We have patched the issue in GitHub commit [4e2565483d0ffcadc719bd44893fb7f609bb5f12](https://github.com/tensorflow/tensorflow/commit/4e2565483d0ffcadc719bd44893fb7f609bb5f12).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Haris Sahovic.
Vulnerability: PYSEC-2021-734
Aliases: GHSA-rgvq-pcvf-hx75, CVE-2021-29608
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. Due to lack of validation in `tf.raw_ops.RaggedTensorToTensor`, an attacker can exploit an undefined behavior if input arguments are empty. The implementation(https://github.com/tensorflow/tensorflow/blob/656e7673b14acd7835dc778867f84916c6d1cac2/tensorflow/core/kernels/ragged_tensor_to_tensor_op.cc#L356-L360) only checks that one of the tensors is not empty, but does not check for the other ones. There are multiple `DCHECK` validations to prevent heap OOB, but these are no-op in release builds, hence they don't prevent anything. The fix will be included in TensorFlow 2.5.0. We will also cherrypick these commits on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-364
Aliases: CVE-2021-41124, GHSA-823f-cwm9-4g74
Published: 2021-10-05T21:15:00Z

Scrapy-splash is a library which provides Scrapy and JavaScript integration. In affected versions users who use [`HttpAuthMiddleware`](http://doc.scrapy.org/en/latest/topics/downloader-middleware.html#module-scrapy.downloadermiddlewares.httpauth) (i.e. the `http_user` and `http_pass` spider attributes) for Splash authentication will have any non-Splash request expose your credentials to the request target. This includes `robots.txt` requests sent by Scrapy when the `ROBOTSTXT_OBEY` setting is set to `True`. Upgrade to scrapy-splash 0.8.0 and use the new `SPLASH_USER` and `SPLASH_PASS` settings instead to set your Splash authentication credentials safely. If you cannot upgrade, set your Splash request credentials on a per-request basis, [using the `splash_headers` request parameter](https://github.com/scrapy-plugins/scrapy-splash/tree/0.8.x#http-basic-auth), instead of defining them globally using the [`HttpAuthMiddleware`](http://doc.scrapy.org/en/latest/topics/downloader-middleware.html#module-scrapy.downloadermiddlewares.httpauth). Alternatively, make sure all your requests go through Splash. That includes disabling the [robots.txt middleware](https://docs.scrapy.org/en/latest/topics/downloader-middleware.html#topics-dlmw-robots).
Vulnerability: PYSEC-2021-671
Aliases: CVE-2021-29545, GHSA-hmg3-c7xj-6qwm
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a denial of service via a `CHECK`-fail in converting sparse tensors to CSR Sparse matrices. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/800346f2c03a27e182dd4fba48295f65e7790739/tensorflow/core/kernels/sparse/kernels.cc#L66) does a double redirection to access an element of an array allocated on the heap. If the value at `indices(i, 0)` is such that `indices(i, 0) + 1` is outside the bounds of `csr_row_ptr`, this results in writing outside of bounds of heap allocated data. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: GHSA-c9qf-r67m-p7cg
Summary: Null pointer dereference in `CompressElement`
Aliases: CVE-2021-37637
Severity: HIGH
CWE: CWE-476
Published: 2021-08-25T14:44:12Z

### Impact
It is possible to trigger a null pointer dereference in TensorFlow by passing an invalid input to `tf.raw_ops.CompressElement`:

```python
import tensorflow as tf

tf.raw_ops.CompressElement(components=[[]])
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/47a06f40411a69c99f381495f490536972152ac0/tensorflow/core/data/compression_utils.cc#L34) was accessing the size of a buffer obtained from the return of a separate function call before validating that said buffer is valid.

### Patches
We have patched the issue in GitHub commit [5dc7f6981fdaf74c8c5be41f393df705841fb7c5](https://github.com/tensorflow/tensorflow/commit/5dc7f6981fdaf74c8c5be41f393df705841fb7c5).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for  more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360. Concurrently, it was resolved in `master` branch as it was also discovered internally and fixed before the report was handled.
Vulnerability: PYSEC-2021-221
Aliases: GHSA-xvjm-fvxx-q3hv, CVE-2021-29584
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a denial of service via a `CHECK`-fail in caused by an integer overflow in constructing a new tensor shape. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/0908c2f2397c099338b901b067f6495a5b96760b/tensorflow/core/kernels/sparse_split_op.cc#L66-L70) builds a dense shape without checking that the dimensions would not result in overflow. The `TensorShape` constructor(https://github.com/tensorflow/tensorflow/blob/6f9896890c4c703ae0a0845394086e2e1e523299/tensorflow/core/framework/tensor_shape.cc#L183-L188) uses a `CHECK` operation which triggers when `InitDims`(https://github.com/tensorflow/tensorflow/blob/6f9896890c4c703ae0a0845394086e2e1e523299/tensorflow/core/framework/tensor_shape.cc#L212-L296) returns a non-OK status. This is a legacy implementation of the constructor and operations should use `BuildTensorShapeBase` or `AddDimWithStatus` to prevent `CHECK`-failures in the presence of overflows. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: GHSA-rjvg-q57v-mjjc
Summary: XSS in Apache Airflow
Aliases: CVE-2019-12398
Severity: MODERATE
CWE: CWE-79
Published: 2020-05-06T19:51:02Z

In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected.
Vulnerability: GHSA-5wrh-4jwv-5w78
Summary: Open redirect via transitional IPv6 addresses on dual-stack networks
Aliases: CVE-2021-21392
Severity: MODERATE
CWE: CWE-601
Published: 2021-04-13T15:13:08Z

### Impact
Requests to user provided domains were not restricted to external IP addresses when transitional IPv6 addresses were used. Outbound requests to federation, identity servers, when calculating the key validity for third-party invite events, sending push notifications, and generating URL previews are affected. This could cause Synapse to make requests to internal infrastructure on dual-stack networks.

### Patches
This issue is fixed by #9240.

### Workarounds
Outbound requests to the following address ranges can be blocked by a firewall, if unused for internal communication between systems:

* `::ffff/80`
* `::0000/80` (note that this IP range is considered deprecated by the IETF)
* `2002::/16` (note that this IP range is considered deprecated by the IETF)

### References
* [RFC3056](https://tools.ietf.org/html/rfc3056)
* [RFC4291](https://tools.ietf.org/html/rfc4291)
Vulnerability: PYSEC-2020-221
Aliases: CVE-2020-25636
Published: 2020-10-05T13:15:00Z

A flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file transfers. Files are written directly to the root bucket, making possible to have collisions when running multiple ansible processes. This issue affects mainly the service availability.
Vulnerability: PYSEC-2021-108
Aliases: GHSA-q2q7-5pp4-w6pg, CVE-2021-33503
Published: 2021-06-29T11:15:00Z

An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.
Vulnerability: PYSEC-2021-558
Aliases: CVE-2021-37645, GHSA-9w2p-5mgw-p94c
Published: 2021-08-12T21:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.QuantizeAndDequantizeV4Grad` is vulnerable to an integer overflow issue caused by converting a signed integer value to an unsigned one and then allocating memory based on this value. The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/quantize_and_dequantize_op.cc#L126) uses the `axis` value as the size argument to `absl::InlinedVector` constructor. But, the constructor uses an unsigned type for the argument, so the implicit conversion transforms the negative value to a large integer. We have patched the issue in GitHub commit 96f364a1ca3009f98980021c4b32be5fdcca33a1. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, and TensorFlow 2.4.3, as these are also affected and still in supported range.
Vulnerability: GHSA-pgcq-h79j-2f69
Summary: Incomplete validation of shapes in multiple TF ops
Aliases: CVE-2021-41206
Severity: HIGH
CWE: CWE-354
Published: 2021-11-10T19:03:38Z

### Impact
Several TensorFlow operations are missing validation for the shapes of the tensor arguments involved in the call. Depending on the API, this can result in undefined behavior and segfault or `CHECK`-fail related crashes but in some scenarios writes and reads from heap populated arrays are also possible.

We have discovered these issues internally via tooling while working on improving/testing GPU op determinism. As such, we don't have reproducers and there will be multiple fixes for these issues.

### Patches
We have patched the issue in GitHub commits [68422b215e618df5ad375bcdc6d2052e9fd3080a](https://github.com/tensorflow/tensorflow/commit/68422b215e618df5ad375bcdc6d2052e9fd3080a), [4d74d8a00b07441cba090a02e0dd9ed385145bf4](https://github.com/tensorflow/tensorflow/commit/4d74d8a00b07441cba090a02e0dd9ed385145bf4), [579261dcd446385831fe4f7457d802a59685121d](https://github.com/tensorflow/tensorflow/commit/579261dcd446385831fe4f7457d802a59685121d), [da4aad5946be30e5f049920fa076e1f7ef021261](https://github.com/tensorflow/tensorflow/commit/da4aad5946be30e5f049920fa076e1f7ef021261), [4dddb2fd0b01cdd196101afbba6518658a2c9e07](https://github.com/tensorflow/tensorflow/commit/4dddb2fd0b01cdd196101afbba6518658a2c9e07), and [e7f497570abb6b4ae5af4970620cd880e4c0c904](https://github.com/tensorflow/tensorflow/commit/e7f497570abb6b4ae5af4970620cd880e4c0c904).

These fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: PYSEC-2014-59
Aliases: CVE-2013-4195
Published: 2014-03-11T19:37:00Z

Multiple open redirect vulnerabilities in (1) marmoset_patch.py, (2) publish.py, and (3) principiaredirect.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Vulnerability: GHSA-3m3h-v9hv-9j4h
Summary: Cross-site Scripting in django-wiki
Aliases: CVE-2021-25986
Severity: MODERATE
CWE: CWE-79
Published: 2021-12-02T17:49:40Z

In Django-wiki, versions 0.0.20 to 0.7.8 are vulnerable to Stored Cross-Site Scripting (XSS) in Notifications Section. An attacker who has access to edit pages can inject JavaScript payload in the title field. When a victim gets a notification regarding the changes made in the application, the payload in the notification panel renders and loads external JavaScript.
Vulnerability: GHSA-57wx-m983-2f88
Summary: Incomplete validation in boosted trees code
Aliases: CVE-2021-41208
Severity: CRITICAL
CWE: CWE-476, CWE-824
Published: 2021-11-10T19:37:56Z

### Impact
The [code for boosted trees in TensorFlow](https://github.com/tensorflow/tensorflow/blob/e0b6e58c328059829c3eb968136f17aa72b6c876/tensorflow/core/kernels/boosted_trees/stats_ops.cc) is still missing validation. As a result, attackers can trigger denial of service (via dereferencing `nullptr`s or via `CHECK`-failures) as well as abuse undefined behavior (binding references to `nullptr`s). An attacker can also read and write from heap buffers, depending on the API that gets used and the arguments that are passed to the call.

**Note**: Given that the boosted trees implementation in TensorFlow is unmaintained, it is recommend to no longer use these APIs.  Instead, please use the downstream [TensorFlow Decision Forests](https://github.com/tensorflow/decision-forests) project which is newer and supports more features. We will deprecate TensorFlow's boosted trees APIs in subsequent releases.

### Patches
We have patched the issue in GitHub commit [5c8c9a8bfe750f9743d0c859bae112060b216f5c](https://github.com/tensorflow/tensorflow/commit/5c8c9a8bfe750f9743d0c859bae112060b216f5c).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: PYSEC-2020-108
Aliases: CVE-2020-28975
Published: 2020-11-21T21:15:00Z

** DISPUTED ** svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn 0.23.2 and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute.
Vulnerability: GHSA-q34h-97wf-8r8j
Summary: vault-cli contains possible RCE when reading user-defined data
Aliases: CVE-2021-43837
Severity: HIGH
CWE: CWE-74
Published: 2021-12-16T21:02:12Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

vault-cli features the ability for rendering templated values (as explained in the [documentation](https://github.com/peopledoc/vault-cli/blob/2.2.1/docs/howto/templated_secrets.rst)). When a secret starts with the prefix `!template!`, vault-cli interprets the rest of the contents of the secret as a Jinja2 template.
Jinja2 is a powerful templating engine and it's not designed to safely render arbitrary templates. An attacker controlling a jinja2 template rendered on a machine can trigger arbitrary code, making this a Remote Code Execution (RCE) risk.
If the content of the vault can be completely trusted, then this is not a problem. Otherwise, if your threat model includes cases where an attacker can manipulate a secret value read from the vault using vault-cli, then this vulnerability may impact you.

This does not impact `vault` itself, except for the fact that the attacker, having an RCE on the machine that executes `vault-cli`, may abuse the token that `vault-cli` uses, to read, write or delete other data from the vault.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

In 3.0.0, the code related to interpreting vault templated secrets has been removed entirely.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Using the environment variable `VAULT_CLI_RENDER=false` or the flag `--no-render` (placed between `vault-cli` and the subcommand, e.g. `vault-cli --no-render get-all`) or adding `render: false` to the vault-cli configuration yaml file disables rendering and removes the vulnerability.
Using the python library, you can use: `vault_cli.get_client(render=False)` when creating your client to get a client that will not render templated secrets and thus operates securely.

### References
_Are there any links users can visit to find out more?_

Here's an article explaining how jinja2 templates might be exploited to have side effects: https://podalirius.net/en/publications/grehack-2021-optimizing-ssti-payloads-for-jinja2/

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the vault-cli repo](https://github.com/peopledoc/vault-cli/issues/new)
Vulnerability: PYSEC-2020-13
Aliases: GHSA-j2h6-73x8-22c4, CVE-2020-1746
Published: 2020-05-12T18:15:00Z

A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the bind_pw in the parameters field. The highest threat from this vulnerability is data confidentiality.
Vulnerability: PYSEC-2018-95
Aliases: CVE-2018-10406
Published: 2018-06-13T22:29:00Z

An issue was discovered in Yelp OSXCollector. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicious unsigned code will execute.
Vulnerability: PYSEC-2022-101
Aliases: CVE-2022-23592, GHSA-vq36-27g6-p492
Published: 2022-02-04T23:15:00Z

Tensorflow is an Open Source Machine Learning Framework. TensorFlow's type inference can cause a heap out of bounds read as the bounds checking is done in a `DCHECK` (which is a no-op during production). An attacker can control the `input_idx` variable such that `ix` would be larger than the number of values in `node_t.args`. The fix will be included in TensorFlow 2.8.0. This is the only affected version.
Vulnerability: PYSEC-2021-86
Aliases: SNYK-PYTHON-QLIB-1054635, CVE-2021-23338
Published: 2021-02-15T16:15:00Z

This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function.
Vulnerability: PYSEC-2021-333
Aliases: CVE-2021-32839, GHSA-p5w8-wqhj-9hhf
Published: 2021-09-20T17:15:00Z

sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a regular Expression Denial of Service in sqlparse vulnerability. The regular expression may cause exponential backtracking on strings containing many repetitions of '\r\n' in SQL comments. Only the formatting feature that removes comments from SQL statements is affected by this regular expression. As a workaround don't use the sqlformat.format function with keyword strip_comments=True or the --strip-comments command line flag when using the sqlformat command line tool. The issues has been fixed in sqlparse 0.4.2.
Vulnerability: PYSEC-2021-763
Aliases: CVE-2021-37652, GHSA-m7fm-4jfh-jrg6
Published: 2021-08-12T22:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation for `tf.raw_ops.BoostedTreesCreateEnsemble` can result in a use after free error if an attacker supplies specially crafted arguments. The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/boosted_trees/resource_ops.cc#L55) uses a reference counted resource and decrements the refcount if the initialization fails, as it should. However, when the code was written, the resource was represented as a naked pointer but later refactoring has changed it to be a smart pointer. Thus, when the pointer leaves the scope, a subsequent `free`-ing of the resource occurs, but this fails to take into account that the refcount has already reached 0, thus the resource has been already freed. During this double-free process, members of the resource object are accessed for cleanup but they are invalid as the entire resource has been freed. We have patched the issue in GitHub commit 5ecec9c6fbdbc6be03295685190a45e7eee726ab. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Vulnerability: GHSA-4mp3-385r-v63f
Summary: Denial of service attack due to invalid JSON
Aliases: CVE-2020-26890
Severity: HIGH
CWE: CWE-20
Published: 2020-11-24T22:58:58Z

### Impact
A denial of service attack against Matrix clients can be exploited by sending an event including invalid JSON data to Synapse. Synapse would relay the data to clients which could crash or hang. Impact is long-lasting if the event is made part of the room state.

### Patches
At a minimum #8106 and #8291 must be applied. #7372 and #8124 include additional checks.

### Workarounds
There are no known workarounds.

### Upgrading notes
If an invalid event is accepted by an earlier Synapse it can become part of the room state and will not be fixed by upgrading Synapse. Redacting the invalid event should avoid clients receiving the invalid event.
Vulnerability: PYSEC-2021-299
Aliases: CVE-2021-37677, GHSA-qfpc-5pjr-mh26
Published: 2021-08-12T23:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the shape inference code for `tf.raw_ops.Dequantize` has a vulnerability that could trigger a denial of service via a segfault if an attacker provides invalid arguments. The shape inference [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/ops/array_ops.cc#L2999-L3014) uses `axis` to select between two different values for `minmax_rank` which is then used to retrieve tensor dimensions. However, code assumes that `axis` can be either `-1` or a value greater than `-1`, with no validation for the other values. We have patched the issue in GitHub commit da857cfa0fde8f79ad0afdbc94e88b5d4bbec764. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2019-230
Aliases: CVE-2018-7575
Published: 2019-04-24T21:29:00Z

Google TensorFlow 1.7.x and earlier is affected by a Buffer Overflow vulnerability. The type of exploitation is context-dependent.
Vulnerability: PYSEC-2020-333
Aliases: CVE-2020-26267, GHSA-c9f3-9wfr-wgh7
Published: 2020-12-10T23:15:00Z

In affected versions of TensorFlow the tf.raw_ops.DataFormatVecPermute API does not validate the src_format and dst_format attributes. The code assumes that these two arguments define a permutation of NHWC. This can result in uninitialized memory accesses, read outside of bounds and even crashes. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.
Vulnerability: PYSEC-2015-23
Aliases: CVE-2015-5964
Published: 2015-08-24T14:59:00Z

The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attackers to cause a denial of service (session store consumption) via unspecified vectors.
Vulnerability: PYSEC-2020-299
Aliases: CVE-2020-26268, GHSA-hhvc-g5hv-48c6
Published: 2020-12-10T23:15:00Z

In affected versions of TensorFlow the tf.raw_ops.ImmutableConst operation returns a constant tensor created from a memory mapped file which is assumed immutable. However, if the type of the tensor is not an integral type, the operation crashes the Python interpreter as it tries to write to the memory area. If the file is too small, TensorFlow properly returns an error as the memory area has fewer bytes than what is needed for the tensor it creates. However, as soon as there are enough bytes, the above snippet causes a segmentation fault. This is because the allocator used to return the buffer data is not marked as returning an opaque handle since the needed virtual method is not overridden. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.
Vulnerability: PYSEC-2020-276
Aliases: GHSA-pg59-2f92-5cph, CVE-2020-15196
Published: 2020-09-25T19:15:00Z

In Tensorflow version 2.3.0, the `SparseCountSparseOutput` and `RaggedCountSparseOutput` implementations don't validate that the `weights` tensor has the same shape as the data. The check exists for `DenseCountSparseOutput`, where both tensors are fully specified. In the sparse and ragged count weights are still accessed in parallel with the data. But, since there is no validation, a user passing fewer weights than the values for the tensors can generate a read from outside the bounds of the heap buffer allocated for the weights. The issue is patched in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and is released in TensorFlow version 2.3.1.
Vulnerability: PYSEC-2021-276
Aliases: CVE-2021-37654, GHSA-2r8p-fg3c-wcj4
Published: 2021-08-12T21:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a crash via a `CHECK`-fail in debug builds of TensorFlow using `tf.raw_ops.ResourceGather` or a read from outside the bounds of heap allocated data in the same API in a release build. The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/resource_variable_ops.cc#L660-L668) does not check that the `batch_dims` value that the user supplies is less than the rank of the input tensor. Since the implementation uses several for loops over the dimensions of `tensor`, this results in reading data from outside the bounds of heap allocated buffer backing the tensor. We have patched the issue in GitHub commit bc9c546ce7015c57c2f15c168b3d9201de679a1d. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-69
Aliases: CVE-2020-35653, GHSA-f5g8-5qq7-938w
Published: 2021-01-12T09:15:00Z

In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.
Vulnerability: GHSA-rv62-4pmj-xw6h
Summary: Moderate severity vulnerability that affects jupyterhub and notebook
Aliases: CVE-2019-10255
Severity: MODERATE
CWE: CWE-601
Published: 2019-04-02T15:46:54Z

An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.8 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.6 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected.
Vulnerability: PYSEC-2021-626
Aliases: CVE-2021-41217, GHSA-5crj-c72x-m7gq
Published: 2021-11-05T21:15:00Z

TensorFlow is an open source platform for machine learning. In affected versions the process of building the control flow graph for a TensorFlow model is vulnerable to a null pointer exception when nodes that should be paired are not. This occurs because the code assumes that the first node in the pairing (e.g., an `Enter` node) always exists when encountering the second node (e.g., an `Exit` node). When this is not the case, `parent` is `nullptr` so dereferencing it causes a crash. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2022-96
Aliases: CVE-2022-23587, GHSA-8jj7-5vxc-pg2q
Published: 2022-02-04T23:15:00Z

Tensorflow is an Open Source Machine Learning Framework. Under certain scenarios, Grappler component of TensorFlow is vulnerable to an integer overflow during cost estimation for crop and resize. Since the cropping parameters are user controlled, a malicious person can trigger undefined behavior. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Vulnerability: GHSA-jj53-8fmw-f2w2
Summary: Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner.
Aliases: CVE-2021-39163
Severity: LOW
CWE: CWE-200
Published: 2021-09-01T18:25:44Z

### Impact
Unauthorised users can access the name, avatar, topic and number of members of a room if they know the ID of the room. This vulnerability is limited to homeservers where:
- the vulnerable homeserver is in the room; and
- untrusted users are permitted to create groups (communities).

By default, only homeserver administrators can create groups. However, homeserver administrators can already access this information in the database or using the admin API. As a result, only homeservers where the configuration setting `enable_group_creation` has been set to `true` are impacted.

### Patches
Server administrators should upgrade to 1.41.1 or higher.

### Workarounds
Server administrators can set `enable_group_creation` to `false` in their homeserver configuration (this is the default value) to prevent creation of groups by non-administrators.

Administrators that are using a reverse proxy could, with partial loss of group functionality, block the following endpoints:
* `/_matrix/client/r0/groups/{group_id}/rooms`
* `/_matrix/client/unstable/groups/{group_id}/rooms`

### References
n/a

### For more information
If you have any questions or comments about this advisory, e-mail us at security@matrix.org.
Vulnerability: PYSEC-2016-33
Aliases: CVE-2014-6276
Published: 2016-04-13T14:59:00Z

schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obtain sensitive user information by viewing user details.
Vulnerability: GHSA-95xm-g58g-3p88
Summary: Integer division by 0 in sparse reshaping
Aliases: CVE-2021-37640
Severity: MODERATE
CWE: CWE-369
Published: 2021-08-25T14:44:02Z

### Impact
The implementation of `tf.raw_ops.SparseReshape` can be made to trigger an integral division by 0 exception:

```python
import tensorflow as tf

tf.raw_ops.SparseReshape(
  input_indices = np.ones((1,3)),
  input_shape = np.array([1,1,0]),
  new_shape = np.array([1,0]))
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/reshape_util.cc#L176-L181) calls the reshaping functor whenever there is at least an index in the input but does not check that shape of the input or the target shape have both a non-zero number of elements.

The [reshape functor](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/reshape_util.cc#L40-L78) blindly divides by the dimensions of the target shape. Hence, if this is not checked, code will result in a division by 0.
  
### Patches
We have patched the issue in GitHub commit [4923de56ec94fff7770df259ab7f2288a74feb41](https://github.com/tensorflow/tensorflow/commit/4923de56ec94fff7770df259ab7f2288a74feb41).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1 as this is the other affected version.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
  
### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-977j-xj7q-2jr9
Summary: Segmentation faultin TensorFlow when converting a Python string to `tf.float16`
Aliases: CVE-2020-5215
Severity: HIGH
CWE: CWE-754
Published: 2020-01-28T21:32:29Z

### Impact

Converting a string (from Python) to a `tf.float16` value results in a segmentation fault in eager mode as the format checks for this use case are only in the graph mode.

This issue can lead to denial of service in inference/training where a malicious attacker can send a data point which contains a string instead of a `tf.float16` value.

Similar effects can be obtained by manipulating saved models and checkpoints whereby replacing a scalar `tf.float16` value with a scalar string will trigger this issue due to automatic conversions.

This can be easily reproduced by `tf.constant("hello", tf.float16)`, if eager execution is enabled.

### Patches
We have patched the vulnerability in GitHub commit [5ac1b9](https://github.com/tensorflow/tensorflow/commit/5ac1b9e24ff6afc465756edf845d2e9660bd34bf).

We are additionally releasing TensorFlow 1.15.1 and 2.0.1 with this vulnerability patched.

TensorFlow 2.1.0 was released after we fixed the issue, thus it is not affected.

We encourage users to switch to TensorFlow 1.15.1, 2.0.1 or 2.1.0.

### For more information

Please consult [`SECURITY.md`](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: PYSEC-2022-156
Aliases: CVE-2022-23592, GHSA-vq36-27g6-p492
Published: 2022-02-04T23:15:00Z

Tensorflow is an Open Source Machine Learning Framework. TensorFlow's type inference can cause a heap out of bounds read as the bounds checking is done in a `DCHECK` (which is a no-op during production). An attacker can control the `input_idx` variable such that `ix` would be larger than the number of values in `node_t.args`. The fix will be included in TensorFlow 2.8.0. This is the only affected version.
Vulnerability: GHSA-r478-c2pc-m7gx
Summary: DNS reply verification issue in dnslinb
Aliases: CVE-2022-22846
Severity: HIGH
Published: 2022-01-12T20:07:10Z

The dnslib package through 0.9.16 for Python does not verify that the ID value in a DNS reply matches an ID value in a query.