TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-5qw5-89mw-wcg2
Summary: Out of bounds write in Tensorflow
Aliases: CVE-2022-23566
Severity: HIGH
CWE: CWE-787
Published: 2022-02-09T23:55:43Z

### Impact
TensorFlow is vulnerable to a heap OOB write in [Grappler](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/costs/graph_properties.cc#L1132-L1141):

```cc
Status SetUnknownShape(const NodeDef* node, int output_port) {
  shape_inference::ShapeHandle shape = 
      GetUnknownOutputShape(node, output_port);
  InferenceContext* ctx = GetContext(node);
  if (ctx == nullptr) {
    return errors::InvalidArgument("Missing context");
  }
  ctx->set_output(output_port, shape);
  return Status::OK();
}
```

The [`set_output`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/shape_inference.h#L394) function writes to an array at the specified index:

```cc
void set_output(int idx, ShapeHandle shape) { outputs_.at(idx) = shape; }
```

Hence, this gives a malicious user a write primitive.

### Patches
We have patched the issue in GitHub commit [97282c6d0d34476b6ba033f961590b783fa184cd](https://github.com/tensorflow/tensorflow/commit/97282c6d0d34476b6ba033f961590b783fa184cd).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: PYSEC-2022-85
Aliases: GHSA-wm93-f238-7v37, CVE-2022-23576
Published: 2022-02-04T23:15:00Z

Tensorflow is an Open Source Machine Learning Framework. The implementation of `OpLevelCostEstimator::CalculateOutputSize` is vulnerable to an integer overflow if an attacker can create an operation which would involve tensors with large enough number of elements. We can have a large enough number of dimensions in `output_shape.dim()` or just a small number of dimensions being large enough to cause an overflow in the multiplication. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Vulnerability: GHSA-r2mj-8wgq-73m6
Summary: XML External Entity Reference in Glances
Aliases: CVE-2021-23418
Severity: MODERATE
CWE: CWE-611
Published: 2021-08-09T20:43:14Z

The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.
Vulnerability: PYSEC-2020-232
Aliases: GHSA-9cfv-9463-8gqv, CVE-2020-15100
Published: 2020-07-14T20:15:00Z

In freewvs before 0.1.1, a user could create a large file that freewvs will try to read, which will terminate a scan process. This has been patched in 0.1.1.
Vulnerability: GHSA-c2jg-hw38-jrqq
Summary: Inconsistent Interpretation of HTTP Requests in twisted.web
Aliases: CVE-2022-24801
Severity: HIGH
CWE: CWE-444
Published: 2022-04-04T21:29:41Z

The Twisted Web HTTP 1.1 server, located in the `twisted.web.http` module, parsed several HTTP request constructs more leniently than permitted by RFC 7230:

1. The Content-Length header value could have a `+` or `-` prefix.
2. Illegal characters were permitted in chunked extensions, such as the LF (`\n`) character.
3. Chunk lengths, which are expressed in hexadecimal format, could have a prefix of `0x`.
4. HTTP headers were stripped of all leading and trailing ASCII whitespace, rather than only space and HTAB (`\t`).

This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling.

### Impact

You may be affected if:

1. You use Twisted Web's HTTP 1.1 server and/or proxy
2. You also pass requests through a different HTTP server and/or proxy

The specifics of the other HTTP parser matter. The original report notes that some versions of Apache Traffic Server and HAProxy have been vulnerable in the past. HTTP request smuggling may be a serious concern if you use a proxy to perform request validation or access control.

The Twisted Web client is not affected. The HTTP 2.0 server uses a different parser, so it is not affected.

### Patches

The issue has been addressed in Twisted 22.4.0rc1 and later.

### Workarounds

Other than upgrading Twisted, you could:

* Ensure any vulnerabilities in upstream proxies have been addressed, such as by upgrading them
* Filter malformed requests by other means, such as configuration of an upstream proxy

### Credits

This issue was initially reported by [Zhang Zeyu](https://github.com/zeyu2001).
Vulnerability: GHSA-2p25-55c9-h58q
Summary: Overflow/crash in `tf.tile` when tiling tensor is large
Aliases: CVE-2021-41198
Severity: MODERATE
CWE: CWE-190
Published: 2021-11-10T19:33:58Z

### Impact
If `tf.tile` is called with a large input argument then the TensorFlow process will crash due to a `CHECK`-failure caused by an overflow.

```python
import tensorflow as tf
import numpy as np
tf.keras.backend.tile(x=np.ones((1,1,1)), n=[100000000,100000000, 100000000])
```

The number of elements in the output tensor is too much for the `int64_t` type and the overflow is detected via a `CHECK` statement. This aborts the process.

### Patches
We have patched the issue in GitHub commit [9294094df6fea79271778eb7e7ae1bad8b5ef98f](https://github.com/tensorflow/tensorflow/commit/9294094df6fea79271778eb7e7ae1bad8b5ef98f) (merging [#51138](https://github.com/tensorflow/tensorflow/pull/51138)).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported externally via a [GitHub issue](https://github.com/tensorflow/tensorflow/issues/46911).
Vulnerability: PYSEC-2021-232
Aliases: CVE-2021-29595, GHSA-vf94-36g5-69v8
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. The implementation of the `DepthToSpace` TFLite operator is vulnerable to a division by zero error(https://github.com/tensorflow/tensorflow/blob/0d45ea1ca641b21b73bcf9c00e0179cda284e7e7/tensorflow/lite/kernels/depth_to_space.cc#L63-L69). An attacker can craft a model such that `params->block_size` is 0. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-662
Aliases: CVE-2021-29536, GHSA-2gfx-95x2-5v3x
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow in `QuantizedReshape` by passing in invalid thresholds for the quantization. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/a324ac84e573fba362a5e53d4e74d5de6729933e/tensorflow/core/kernels/quantized_reshape_op.cc#L38-L55) assumes that the 2 arguments are always valid scalars and tries to access the numeric value directly. However, if any of these tensors is empty, then `.flat<T>()` is an empty buffer and accessing the element at position 0 results in overflow. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-398
Aliases: CVE-2021-41205, GHSA-49rx-x2rw-pc6f
Published: 2021-11-05T21:15:00Z

TensorFlow is an open source platform for machine learning. In affected versions the shape inference functions for the `QuantizeAndDequantizeV*` operations can trigger a read outside of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-377
Aliases: CVE-2021-32609
Published: 2021-10-18T15:15:00Z

Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title, injecting html (including scripts) into the page.
Vulnerability: PYSEC-2021-727
Aliases: CVE-2021-29601, GHSA-9c84-4hx6-xmm4
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. The TFLite implementation of concatenation is vulnerable to an integer overflow issue(https://github.com/tensorflow/tensorflow/blob/7b7352a724b690b11bfaae2cd54bc3907daf6285/tensorflow/lite/kernels/concatenation.cc#L70-L76). An attacker can craft a model such that the dimensions of one of the concatenation input overflow the values of `int`. TFLite uses `int` to represent tensor dimensions, whereas TF uses `int64`. Hence, valid TF models can trigger an integer overflow when converted to TFLite format. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2011-24
Aliases: CVE-2010-4340
Published: 2011-09-12T12:41:00Z

libcloud before 0.4.1 does not verify SSL certificates for HTTPS connections, which allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle (MITM) attack.
Vulnerability: PYSEC-2013-19
Aliases: CVE-2013-4249
Published: 2013-10-04T17:55:00Z

Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField.
Vulnerability: GHSA-44qp-9wwf-734r
Summary: Heap overflow in Tensorflow
Aliases: CVE-2022-21740
Severity: HIGH
CWE: CWE-120, CWE-787
Published: 2022-02-09T23:47:14Z

### Impact 
The [implementation of `SparseCountSparseOutput`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/count_ops.cc#L168-L273) is vulnerable to a heap overflow:

```python
import tensorflow as tf
import numpy as np

tf.raw_ops.SparseCountSparseOutput(
  indices=[[-1,-1]],
  values=[2],
  dense_shape=[1, 1],
  weights=[1],
  binary_output=True,
  minlength=-1,
  maxlength=-1,
  name=None)
```

### Patches
We have patched the issue in GitHub commits [2b7100d6cdff36aa21010a82269bc05a6d1cc74a](https://github.com/tensorflow/tensorflow/commit/2b7100d6cdff36aa21010a82269bc05a6d1cc74a) and [adbbabdb0d3abb3cdeac69e38a96de1d678b24b3](https://github.com/tensorflow/tensorflow/commit/adbbabdb0d3abb3cdeac69e38a96de1d678b24b3).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
Vulnerability: GHSA-m43c-649m-pm48
Summary: Integer Overflow or Wraparound in OpenCV.
Aliases: CVE-2017-1000450
Severity: HIGH
CWE: CWE-190
Published: 2021-10-12T22:03:32Z

In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniColor and FillUniGray do not check the input length, which can lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 (corresponding with OpenCV-Python 3.3.0.9) and earlier.
Vulnerability: PYSEC-2022-112
Aliases: GHSA-98j8-c9q4-r38g, CVE-2022-21733
Published: 2022-02-03T12:15:00Z

Tensorflow is an Open Source Machine Learning Framework. The implementation of `StringNGrams` can be used to trigger a denial of service attack by causing an out of memory condition after an integer overflow. We are missing a validation on `pad_witdh` and that result in computing a negative value for `ngram_width` which is later used to allocate parts of the output. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Vulnerability: GHSA-fh56-85cw-5pq6
Summary: Out-of-bounds Write in ujson
Aliases: CVE-2021-45958
Severity: MODERATE
CWE: CWE-787
Published: 2022-01-21T23:27:45Z

UltraJSON (aka ujson) 4.0.2 through 5.0.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode).
Vulnerability: PYSEC-2018-86
Aliases: GHSA-6mww-xvh7-fq4f, CVE-2018-1002150
Published: 2018-04-04T20:29:00Z

Koji version 1.12, 1.13, 1.14 and 1.15 contain an incorrect access control vulnerability resulting in arbitrary filesystem read/write access. This vulnerability has been fixed in versions 1.12.1, 1.13.1, 1.14.1 and 1.15.1.
Vulnerability: GHSA-f4w8-cv6p-x6r5
Summary: Denial of Service by Uncontrolled Resource Consumption
Aliases: CVE-2021-27921
Severity: HIGH
CWE: CWE-400
Published: 2021-03-18T19:55:13Z

Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.
Vulnerability: PYSEC-2018-69
Aliases: GHSA-f2j6-wrhh-v25m, CVE-2018-1000805
Published: 2018-10-08T15:29:00Z

Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity.
Vulnerability: GHSA-fffj-9qwg-qmh5
Summary: Improper Input Validation in OpenCV
Aliases: CVE-2016-1517
Severity: MODERATE
CWE: CWE-20
Published: 2021-10-12T22:00:31Z

OpenCV 3.0.0 allows remote attackers to cause a denial of service (segfault) via vectors involving corrupt chunks. This issue was fixed in OpenCV version 3.3.1 (corresponding to OpenCV 3.3.1.11).
Vulnerability: PYSEC-2021-818
Aliases: CVE-2021-41211, GHSA-cvgx-3v3q-m36c
Published: 2021-11-05T21:15:00Z

TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `QuantizeV2` can trigger a read outside of bounds of heap allocated array. This occurs whenever `axis` is a negative value less than `-1`. In this case, we are accessing data before the start of a heap buffer. The code allows `axis` to be an optional argument (`s` would contain an `error::NOT_FOUND` error code). Otherwise, it assumes that `axis` is a valid index into the dimensions of the `input` tensor. If `axis` is less than `-1` then this results in a heap OOB read. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected.
Vulnerability: GHSA-38rv-5jqc-m2cv
Summary: High severity vulnerability that affects recurly
Aliases: CVE-2017-0906
Severity: HIGH
CWE: CWE-918
Published: 2019-01-04T17:48:09Z

The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource.get" method that could result in compromise of API keys or other critical resources.
Vulnerability: PYSEC-2017-21
Aliases: CVE-2017-5936
Published: 2017-04-12T22:59:00Z

OpenStack Nova-LXD before 13.1.1 uses the wrong name for the veth pairs when applying Neutron security group rules for instances, which allows remote attackers to bypass intended security restrictions.
Vulnerability: GHSA-7g9h-c88w-r7h2
Summary: High severity vulnerability that affects django
Aliases: CVE-2011-0698
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T19:52:31Z

Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / (slash) character in a key in a session cookie, related to session replays.
Vulnerability: GHSA-j7c4-2xj8-wm7r
Summary: Moderate severity vulnerability that affects kdcproxy
Aliases: CVE-2015-5159
Severity: HIGH
CWE: CWE-20
Published: 2018-11-01T14:49:30Z

python-kdcproxy before 0.3.2 allows remote attackers to cause a denial of service via a large POST request.
Vulnerability: GHSA-77g3-3j5w-64w4
Summary: Exposure of Resource to Wrong Sphere and Insecure Temporary File in Ansible
Aliases: CVE-2020-10685
Severity: LOW
CWE: CWE-668, CWE-459, CWE-377
Published: 2021-04-07T20:36:46Z

A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the s ts unencrypted. On Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decryp emains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted ble.
Vulnerability: PYSEC-2020-249
Aliases: CVE-2013-1895, GHSA-r838-q6jp-58xx
Published: 2020-01-28T15:15:00Z

The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.
Vulnerability: GHSA-gcr6-rf47-jrgf
Summary: Loaded Databook of Tablib prone to python insertion resulting in command execution
Aliases: CVE-2017-2810
Severity: CRITICAL
Published: 2018-07-13T16:01:25Z

An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4. A yaml loaded Databook can execute arbitrary python commands resulting in command execution. An attacker can insert python into loaded yaml to trigger this vulnerability.
Vulnerability: PYSEC-2021-249
Aliases: CVE-2021-29612, GHSA-2xgj-xhgf-ggjv
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a heap buffer overflow in Eigen implementation of `tf.raw_ops.BandedTriangularSolve`. The implementation(https://github.com/tensorflow/tensorflow/blob/eccb7ec454e6617738554a255d77f08e60ee0808/tensorflow/core/kernels/linalg/banded_triangular_solve_op.cc#L269-L278) calls `ValidateInputTensors` for input validation but fails to validate that the two tensors are not empty. Furthermore, since `OP_REQUIRES` macro only stops execution of current function after setting `ctx->status()` to a non-OK value, callers of helper functions that use `OP_REQUIRES` must check value of `ctx->status()` before continuing. This doesn't happen in this op's implementation(https://github.com/tensorflow/tensorflow/blob/eccb7ec454e6617738554a255d77f08e60ee0808/tensorflow/core/kernels/linalg/banded_triangular_solve_op.cc#L219), hence the validation that is present is also not effective. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: GHSA-fj67-w3m4-rfmp
Summary: Cross-site scripting in Plone
Aliases: CVE-2021-33513
Severity: MODERATE
CWE: CWE-79
Published: 2021-06-08T23:19:28Z

Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool.
Vulnerability: GHSA-vv2x-vrpj-qqpq
Summary: Cross-site scripting in Bleach
Aliases: CVE-2021-23980
Severity: MODERATE
CWE: CWE-79
Published: 2021-02-02T17:58:40Z

### Impact                                                                                                                                                                                                                                                    

A [mutation XSS](https://cure53.de/fp170.pdf) affects users calling `bleach.clean` with all of:

* `svg` or `math` in the allowed tags
* `p` or `br` in allowed tags
* `style`, `title`, `noscript`, `script`, `textarea`, `noframes`, `iframe`, or `xmp` in allowed tags
* the keyword argument `strip_comments=False`

Note: none of the above tags are in the default allowed tags and `strip_comments` defaults to `True`.

### Patches

Users are encouraged to upgrade to bleach v3.3.0 or greater.

Note: bleach v3.3.0 introduces a breaking change to escape HTML comments by default.

### Workarounds

* modify `bleach.clean` calls to at least one of:
  * not allow the `style`, `title`, `noscript`, `script`, `textarea`, `noframes`, `iframe`, or `xmp` tag
  * not allow `svg` or `math` tags
  * not allow `p` or `br` tags
  * set `strip_comments=True`

* A strong [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) without `unsafe-inline` and `unsafe-eval` [`script-src`s](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)) will also help mitigate the risk.

### References

* https://bugzilla.mozilla.org/show_bug.cgi?id=1689399
* https://advisory.checkmarx.net/advisory/CX-2021-4303
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23980
* https://cure53.de/fp170.pdf

### Credits

* Reported by [Yaniv Nizry](https://twitter.com/ynizry) from the CxSCA AppSec group at Checkmarx
* Additional eject tags not mentioned in the original advisory and the CSP mitigation line being truncated in the revised advisory reported by [Michał Bentkowski](https://twitter.com/SecurityMB) at Securitum

### For more information

If you have any questions or comments about this advisory:

* Open an issue at [https://github.com/mozilla/bleach/issues](https://github.com/mozilla/bleach/issues)
* Email us at [security@mozilla.org](mailto:security@mozilla.org)
Vulnerability: PYSEC-2021-619
Aliases: GHSA-m342-ff57-4jcc, CVE-2021-41210
Published: 2021-11-05T20:15:00Z

TensorFlow is an open source platform for machine learning. In affected versions the shape inference functions for `SparseCountSparseOutput` can trigger a read outside of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Vulnerability: GHSA-hm2p-fhwx-9285
Summary: Incorrect Permission Assignment for Critical Resource	in Plone
Aliases: CVE-2021-33509
Severity: CRITICAL
CWE: CWE-732
Published: 2021-06-15T16:11:38Z

Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script.
Vulnerability: PYSEC-2021-56
Aliases: CVE-2021-31607
Published: 2021-04-23T06:15:00Z

In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).
Vulnerability: PYSEC-2018-12
Aliases: CVE-2018-19787
Published: 2018-12-02T10:29:00Z

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.
Vulnerability: PYSEC-2020-94
Aliases: GHSA-qf7v-8hj3-4xw7, CVE-2020-5390
Published: 2020-01-13T19:15:00Z

PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping (XSW). The signature information and the node/object that is signed can be in different places and thus the signature verification will succeed, but the wrong data will be used. This specifically affects the verification of assertion that have been signed.
Vulnerability: PYSEC-2021-863
Aliases: GHSA-c4rh-4376-gff4, CVE-2021-40830
Published: 2021-11-23T00:15:00Z

The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on Unix systems. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store. Attackers with access to a host’s trust stores or are able to compromise a certificate authority already in the host's trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker's data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user's private keys to authenticate against the MQTT broker. The 'aws_tls_ctx_options_override_default_trust_store_*' function within the aws-c-io submodule has been updated to override the default trust store. This corrects this issue. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.5.0 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Linux/Unix. Amazon Web Services AWS-C-IO 0.10.4 on Linux/Unix.
Vulnerability: PYSEC-2020-160
Aliases: GHSA-3m93-m4q6-mc6v, CVE-2019-14864
Published: 2020-01-02T15:15:00Z

Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.
Vulnerability: GHSA-9gjv-6qq6-v7qm
Summary: 2FA bypass through deleting devices in wagtail-2fa
Aliases: CVE-2020-5240
Severity: HIGH
CWE: CWE-285
Published: 2020-03-13T21:18:55Z

### Impact
Any user with access to the CMS can view and delete other users&#39; 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other user&#39;s device they can disable the target user&#39;s 2FA devices and potentially compromise the account if they figure out their password.

### Patches
The problem has been patched in version 1.4.1.

### Workarounds
There is no workaround for this issue.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [github.com/labd/wagtail-2fa](https://github.com/labd/wagtail-2fa)
* Email us at [security@labdigital.nl](mailto:security@labdigital.nl)
Vulnerability: PYSEC-2021-530
Aliases: GHSA-rf3h-xgv5-2q39, CVE-2021-29602
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. The implementation of the `DepthwiseConv` TFLite operator is vulnerable to a division by zero error(https://github.com/tensorflow/tensorflow/blob/1a8e885b864c818198a5b2c0cbbeca5a1e833bc8/tensorflow/lite/kernels/depthwise_conv.cc#L287-L288). An attacker can craft a model such that `input`'s fourth dimension would be 0. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2014-31
Aliases: GHSA-879r-7f3w-8jj3, CVE-2012-5489
Published: 2014-09-30T14:55:00Z

The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.
Vulnerability: PYSEC-2021-160
Aliases: GHSA-2cpx-427x-q2c6, CVE-2021-29523
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a denial of service via a `CHECK`-fail in `tf.raw_ops.AddManySparseToTensorsMap`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/6f9896890c4c703ae0a0845394086e2e1e523299/tensorflow/core/kernels/sparse_tensors_map_ops.cc#L257) takes the values specified in `sparse_shape` as dimensions for the output shape. The `TensorShape` constructor(https://github.com/tensorflow/tensorflow/blob/6f9896890c4c703ae0a0845394086e2e1e523299/tensorflow/core/framework/tensor_shape.cc#L183-L188) uses a `CHECK` operation which triggers when `InitDims`(https://github.com/tensorflow/tensorflow/blob/6f9896890c4c703ae0a0845394086e2e1e523299/tensorflow/core/framework/tensor_shape.cc#L212-L296) returns a non-OK status. This is a legacy implementation of the constructor and operations should use `BuildTensorShapeBase` or `AddDimWithStatus` to prevent `CHECK`-failures in the presence of overflows. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: GHSA-vgv5-cxvh-vfxh
Summary: Arbitrary code execution in clickhouse-driver
Aliases: CVE-2020-26759
Severity: CRITICAL
CWE: CWE-120
Published: 2021-04-07T20:50:57Z

clickhouse-driver before 0.1.5 allows a malicious clickhouse server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, due to a buffer overflow.
Vulnerability: PYSEC-2021-475
Aliases: GHSA-4fg4-p75j-w5xj, CVE-2021-29547
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a segfault and denial of service via accessing data outside of bounds in `tf.raw_ops.QuantizedBatchNormWithGlobalNormalization`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/55a97caa9e99c7f37a0bbbeb414dc55553d3ae7f/tensorflow/core/kernels/quantized_batch_norm_op.cc#L176-L189) assumes the inputs are not empty. If any of these inputs is empty, `.flat<T>()` is an empty buffer, so accessing the element at index 0 is accessing data outside of bounds. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: GHSA-pw3c-h7wp-cvhx
Summary: Improper Initialization in Pillow
Aliases: CVE-2022-22815
Severity: CRITICAL
CWE: CWE-665
Published: 2022-01-12T20:07:43Z

Pillow is the friendly PIL (Python Imaging Library) fork. path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.
Vulnerability: PYSEC-2022-169
Aliases: CVE-2022-24761, GHSA-4f7p-27jc-3c36
Published: 2022-03-17T13:15:00Z

Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and prior behind a proxy that does not properly validate the incoming HTTP request matches the RFC7230 standard, Waitress and the frontend proxy may disagree on where one request starts and where it ends. This would allow requests to be smuggled via the front-end proxy to waitress and later behavior. There are two classes of vulnerability that may lead to request smuggling that are addressed by this advisory: The use of Python's `int()` to parse strings into integers, leading to `+10` to be parsed as `10`, or `0x01` to be parsed as `1`, where as the standard specifies that the string should contain only digits or hex digits; and Waitress does not support chunk extensions, however it was discarding them without validating that they did not contain illegal characters. This vulnerability has been patched in Waitress 2.1.1. A workaround is available. When deploying a proxy in front of waitress, turning on any and all functionality to make sure that the request matches the RFC7230 standard. Certain proxy servers may not have this functionality though and users are encouraged to upgrade to the latest version of waitress instead.
Vulnerability: GHSA-pq64-v7f5-gqh8
Summary: Regular Expression Denial of Service (ReDoS) in Pygments
Aliases: CVE-2021-27291
Severity: MODERATE
CWE: CWE-400
Published: 2021-03-29T16:33:03Z

In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.
Vulnerability: PYSEC-2022-46
Aliases: GHSA-99p8-9p2c-49j4, CVE-2022-21695
Published: 2022-01-18T22:15:00Z

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions authenticated users (or unauthenticated in public mode) can send messages without being visible in the list of chat participants. This issue has been resolved in version 2.5.
Vulnerability: PYSEC-2019-126
Aliases: CVE-2019-12105
Published: 2019-09-10T17:15:00Z

** DISPUTED ** In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Note: The maintainer responded that the affected component, inet_http_server, is not enabled by default but if the user enables it and does not set a password, Supervisor logs a warning message. The maintainer indicated the ability to run an open server will not be removed but an additional warning was added to the documentation.
Vulnerability: GHSA-c7vm-f5p4-8fqh
Summary: Open redirect in Jupyter Notebook
Aliases: CVE-2020-26215
Severity: MODERATE
CWE: CWE-601
Published: 2020-11-18T21:06:36Z

[localhost](http://localhost:8888)

### Impact
_What kind of vulnerability is it? Who is impacted?_

Open redirect vulnerability - a maliciously crafted link to a notebook server could redirect the browser to a different website.

All notebook servers are technically affected, however, these maliciously crafted links can only be reasonably made for known notebook server hosts. A link to your notebook server may *appear* safe, but ultimately redirect to a spoofed server on the public internet.

### Patches

_Has the problem been patched? What versions should users upgrade to?_

Patched in notebook 6.1.5


### References

[OWASP page on open redirects](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)

### For more information

If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list [security@ipython.org](mailto:security@ipython.org).

Credit: zhuonan li of Alibaba Application Security Team
Vulnerability: PYSEC-2017-76
Aliases: CVE-2017-17554
Published: 2017-12-12T01:29:00Z

A NULL pointer dereference (DoS) Vulnerability was found in the function aubio_source_avcodec_readframe in io/source_avcodec.c of aubio 0.4.6, which may lead to DoS when playing a crafted audio file.
Vulnerability: GHSA-8278-88vv-x98r
Summary: Execution of untrusted code through config file
Aliases: CVE-2021-21371
Severity: MODERATE
CWE: CWE-502
Published: 2021-03-10T21:51:17Z

### Impact
It is possible to run arbitrary commands through the yaml.load() method.  This could allow an attacker with local access to the host to run arbitrary code by running the application with a specially crafted YAML configuration file.

### Workarounds
Manually adjust yaml.load() to yaml.safe_load()

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [tenable/integration-jira-cloud](https://github.com/tenable/integration-jira-cloud/issues)
* Email us at [vulnreport@tenable.com](mailto:vulnreport@tenable.com)
Vulnerability: GHSA-hhm3-48h2-597v
Summary: Insufficiently Protected Credentials in Apache Superset
Aliases: CVE-2021-44451
Severity: MODERATE
CWE: CWE-522
Published: 2022-02-02T00:01:46Z

Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way. Users should upgrade to Apache Superset 1.4.0 or higher.
Vulnerability: GHSA-95q3-8gr9-gm8w
Summary: Denial of Service by Uncontrolled Resource Consumption
Aliases: CVE-2021-27923
Severity: HIGH
CWE: CWE-400
Published: 2021-03-18T19:54:43Z

Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.
Vulnerability: GHSA-gff3-739c-gxfq
Summary: Reflected cross-site scripting issue in Datasette
Aliases: CVE-2021-32670
Severity: HIGH
CWE: CWE-79
Published: 2021-06-10T17:22:59Z

Datasette is an open source multi-tool for exploring and publishing data. The `?_trace=1` debugging feature in Datasette does not correctly escape generated HTML, resulting in a [reflected cross-site scripting](https://owasp.org/www-community/attacks/xss/#reflected-xss-attacks) vulnerability. This vulnerability is particularly relevant if your Datasette installation includes authenticated features using plugins such as [datasette-auth-passwords](https://datasette.io/plugins/datasette-auth-passwords) as an attacker could use the vulnerability to access protected data. Datasette 0.57 and 0.56.1 both include patches for this issue. If you run Datasette behind a proxy you can workaround this issue by rejecting any incoming requests with `?_trace=` or `&_trace=` in their query string parameters.
Vulnerability: GHSA-9j2c-x8qm-qmjq
Summary: SQL injection in Tortoise ORM
Aliases: CVE-2020-11010
Severity: MODERATE
CWE: CWE-89
Published: 2020-04-20T21:31:23Z

### Impact
Various forms of SQL injection has been found, for MySQL and when filtering or doing mass-updates on char/text fields.
SQLite & PostgreSQL was only affected when filtering with ``contains``, ``starts_with`` or ``ends_with`` filters (and their case-insensitive counterparts)


### Patches
Please upgrade to 0.15.23+ or 0.16.6+

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Github](https://github.com/tortoise/tortoise-orm/issues)
* Chat to us on [Gitter](https://gitter.im/tortoise/community)
Vulnerability: PYSEC-2017-99
Aliases: CVE-2015-8309
Published: 2017-03-27T15:59:00Z

Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "download."
Vulnerability: PYSEC-2010-8
Aliases: CVE-2009-5011
Published: 2010-10-19T20:00:00Z

Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.2 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the getpeername function having an ENOTCONN error, a different vulnerability than CVE-2010-3494.
Vulnerability: GHSA-xp5m-4c9f-498q
Summary: Moderate severity vulnerability that affects django-epiceditor
Aliases: CVE-2017-6591
Severity: MODERATE
CWE: CWE-79
Published: 2018-07-13T15:17:18Z

There is a cross-site scripting vulnerability in django-epiceditor 0.2.3 via crafted content in a form field.
Vulnerability: GHSA-pwfw-mgfj-7g3g
Summary: Low severity vulnerability that affects ecdsa
Aliases: CVE-2019-14853
Severity: HIGH
CWE: CWE-755, CWE-391
Published: 2019-10-08T16:30:17Z

## possible DoS in signature verification and signature malleability 

### Impact
Code using `VerifyingKey.verify()` and `VerifyingKey.verify_digest()` may receive exceptions other than the documented `BadSignatureError` when signatures are malformed. If those other exceptions are not caught, they may lead to program termination and thus Denial of Service

Code using `VerifyingKey.verify()` and `VerifyingKey.verify_digest()` with `sigdecode` option using `ecdsa.util.sigdecode_der` will accept signatures even if they are not properly formatted DER. This makes the signatures malleable. It impacts only applications that later sign the signatures or verify signatures of signatures, e.g. Bitcoin.

All versions between 0.5 and 0.13.2 (inclusive) are thought to be vulnerable. Code before 0.5 may be vulnerable but didn't receive extended analysis to rule this issue out.

### Patches
The patches have been merged to `master` branch in https://github.com/warner/python-ecdsa/pull/115.
The backported patches for a release in the 0.13 branch are in https://github.com/warner/python-ecdsa/pull/124

They are part of the 0.13.3 release.

There are no plans to backport them to earlier releases.

### Workarounds
It may be possible to prevent the Denial of Service by catching also `UnexpectedDER`, `IndexError` and `AssertionError` exceptions. That list hasn't been verified to be complete though. If those exceptions are raised, the signature verification process should consider the signature to be invalid.

To remediate signature malleability and the Denial of Service vulnerability, it may be possible to first verify that the signature is properly DER formatted ECDSA-Sig-Value, as defined in [RFC3279](https://tools.ietf.org/html/rfc3279), before passing it to `verify()` or `verify_digest()` methods. If the signature is determined to not follow the DER or encode a different structure, the signature verification process should consider the signature to be invalid.

### References
https://en.bitcoinwiki.org/wiki/Transaction_Malleability

### For more information
If you have any questions or comments about this advisory please open an issue in [python-ecdsa](https://github.com/warner/python-ecdsa/issues) project.
Vulnerability: GHSA-5phf-pp7p-vc2r
Summary: Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection
Aliases: CVE-2021-28363
Severity: MODERATE
CWE: CWE-295
Published: 2021-03-19T19:42:11Z

### Impact

Users who are using an HTTPS proxy to issue HTTPS requests and haven't configured their own SSLContext via `proxy_config`.
Only the default SSLContext is impacted.

### Patches

[urllib3 >=1.26.4 has the issue resolved](https://github.com/urllib3/urllib3/releases/tag/1.26.4). urllib3<1.26 is not impacted due to not supporting HTTPS requests via HTTPS proxies.

### Workarounds

Upgrading is recommended as this is a minor release and not likely to break current usage.

Configuring an `SSLContext` with `check_hostname=True` and passing via `proxy_config` instead of relying on the default `SSLContext`

### For more information
If you have any questions or comments about this advisory:
* Email us at [sethmichaellarson@gmail.com](mailto:sethmichaellarson@gmail.com)
Vulnerability: GHSA-7257-96vg-qf6x
Summary: Remote Code Execution in Red Discord Bot
Aliases: CVE-2020-15147
Severity: HIGH
CWE: CWE-94, CWE-74
Published: 2020-08-21T17:03:24Z

### Impact
A RCE exploit has been discovered in the Streams module: this exploit allows Discord users with specifically crafted "going live" messages to inject code into the Streams module's going live message. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information.

### Patches
This critical exploit has been fixed on version ``3.3.12`` & ``3.4``.

### Workarounds
Unloading the Streams module with ``unload streams`` can render this exploit not accessible. We still highly recommend updating to ``3.3.12`` or ``3.4`` to completely patch this issue.

### References
* https://github.com/Cog-Creators/Red-DiscordBot/pull/4183

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Cog-Creators/Red-DiscordBot](https://github.com/Cog-Creators/Red-DiscordBot)
* Over on our [Discord server](https://discord.gg/red)
Vulnerability: PYSEC-2021-137
Aliases: GHSA-77gc-v2xv-rvvh, CVE-2021-25287
Published: 2021-06-02T16:15:00Z

An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.
Vulnerability: PYSEC-2014-66
Aliases: CVE-2013-7061
Published: 2014-05-02T14:55:00Z

Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API.
Vulnerability: GHSA-fhpf-pp6p-55qc
Summary: Unsafe handling of user-specified cookies in treq
Aliases: CVE-2022-23607
Severity: MODERATE
CWE: CWE-601, CWE-200
Published: 2022-02-01T00:43:38Z

### Impact

Treq's request methods (`treq.get`, `treq.post`, `HTTPClient.request`, `HTTPClient.get`, etc.) accept cookies as a dictionary, for example:

```py
treq.get('https://example.com/', cookies={'session': '1234'})
```

Such cookies are not bound to a single domain, and are therefore sent to *every* domain ("supercookies"). This can potentially cause sensitive information to leak upon an HTTP redirect to a different domain., e.g. should `https://example.com` redirect to `http://cloudstorageprovider.com` the latter will receive the cookie `session`.

### Patches

Treq 2021.1.0 and later bind cookies given to request methods (`treq.request`, `treq.get`, `HTTPClient.request`, `HTTPClient.get`, etc.) to the origin of the *url* parameter.

### Workarounds

Instead of passing a dictionary as the *cookies* argument, pass a `http.cookiejar.CookieJar` instance with properly domain- and scheme-scoped cookies in it:

```py
from http.cookiejar import CookieJar
from requests.cookies import create_cookie

jar = CookieJar()
jar.add_cookie(
    create_cookie(
        name='session',
        value='1234',
        domain='example.com',
        secure=True,
    ),
)
client = HTTPClient(cookies=jar)
client.get('https://example.com/')
```

### References

* Originally reported at [huntr.dev](https://huntr.dev/bounties/3c9204fc-a3d1-4441-8599-924c5f57e7ae/?token=06d930e37046c914bcb037e85cc227dc7b510b475989fc69837566562ba899277d46b0fb4b1e21cdcb6ddc1b7d9b1ded632cf3a3551ecb89afca16a63b34641284b50479d5195bba2ac09b116f3dd4fad27f54404c2de922c05c8c8b744aec27bb4d4d198cb8b3abf479af0c2d5fbaa10412da7922594ac3eb39)
* A related issue in the handling of HTTP basic authentication was addressed in Twisted 22.1 ([GHSA-92x2-jw7w-xvvx](https://github.com/twisted/twisted/security/advisories/GHSA-92x2-jw7w-xvvx), CVE-2022-21712).
Vulnerability: PYSEC-2021-567
Aliases: CVE-2021-37654, GHSA-2r8p-fg3c-wcj4
Published: 2021-08-12T21:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a crash via a `CHECK`-fail in debug builds of TensorFlow using `tf.raw_ops.ResourceGather` or a read from outside the bounds of heap allocated data in the same API in a release build. The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/resource_variable_ops.cc#L660-L668) does not check that the `batch_dims` value that the user supplies is less than the rank of the input tensor. Since the implementation uses several for loops over the dimensions of `tensor`, this results in reading data from outside the bounds of heap allocated buffer backing the tensor. We have patched the issue in GitHub commit bc9c546ce7015c57c2f15c168b3d9201de679a1d. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.