TQRG/raw-osv-data huggingface dataset:
Vulnerability: PYSEC-2021-464
Aliases: CVE-2021-29536, GHSA-2gfx-95x2-5v3x
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow in `QuantizedReshape` by passing in invalid thresholds for the quantization. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/a324ac84e573fba362a5e53d4e74d5de6729933e/tensorflow/core/kernels/quantized_reshape_op.cc#L38-L55) assumes that the 2 arguments are always valid scalars and tries to access the numeric value directly. However, if any of these tensors is empty, then `.flat<T>()` is an empty buffer and accessing the element at position 0 results in overflow. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2022-57
Aliases: GHSA-98j8-c9q4-r38g, CVE-2022-21733
Published: 2022-02-03T12:15:00Z

Tensorflow is an Open Source Machine Learning Framework. The implementation of `StringNGrams` can be used to trigger a denial of service attack by causing an out of memory condition after an integer overflow. We are missing a validation on `pad_witdh` and that result in computing a negative value for `ngram_width` which is later used to allocate parts of the output. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Vulnerability: PYSEC-2019-137
Aliases: CVE-2019-16786, GHSA-g2xc-35jw-c63p
Published: 2019-12-20T23:15:00Z

Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding should be a comma separated list, with the inner-most encoding first, followed by any further transfer codings, ending with chunked. Requests sent with: "Transfer-Encoding: gzip, chunked" would incorrectly get ignored, and the request would use a Content-Length header instead to determine the body size of the HTTP message. This could allow for Waitress to treat a single request as multiple requests in the case of HTTP pipelining. This issue is fixed in Waitress 1.4.0.
Vulnerability: GHSA-qg48-85hg-mqc5
Summary: Division by 0 in `DenseCountSparseOutput`
Aliases: CVE-2021-29554
Severity: LOW
CWE: CWE-369
Published: 2021-05-21T14:23:55Z

### Impact
An attacker can cause a denial of service via a FPE runtime error in `tf.raw_ops.DenseCountSparseOutput`:

```python
import tensorflow as tf

values = tf.constant([], shape=[0, 0], dtype=tf.int64)
weights = tf.constant([])

tf.raw_ops.DenseCountSparseOutput(
  values=values, weights=weights,
  minlength=-1, maxlength=58, binary_output=True)
```
  
This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/efff014f3b2d8ef6141da30c806faf141297eca1/tensorflow/core/kernels/count_ops.cc#L123-L127) computes a divisor value from user data but does not check that the result is 0 before doing the division:

```cc
int num_batch_elements = 1;
for (int i = 0; i < num_batch_dimensions; ++i) {
  num_batch_elements *= data.shape().dim_size(i);
}
int num_value_elements = data.shape().num_elements() / num_batch_elements;
```

Since `data` is given by the `values` argument, `num_batch_elements` is 0.

### Patches
We have patched the issue in GitHub commit [da5ff2daf618591f64b2b62d9d9803951b945e9f](https://github.com/tensorflow/tensorflow/commit/da5ff2daf618591f64b2b62d9d9803951b945e9f).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, and TensorFlow 2.3.3, as these are also affected.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-fvx8-v524-8579
Summary: Cleartext Storage of Sensitive Information
Aliases: CVE-2020-17495
Severity: HIGH
CWE: CWE-312
Published: 2021-06-04T21:46:52Z

django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database.
Vulnerability: PYSEC-2018-8
Aliases: GHSA-8jxq-75rw-fhj9, CVE-2018-8097
Published: 2018-03-14T12:29:00Z

io/mongo/parser.py in Eve (aka pyeve) before 0.7.5 allows remote attackers to execute arbitrary code via Code Injection in the where parameter.
Vulnerability: GHSA-3rcw-9p9x-582v
Summary: Code injection in `saved_model_cli`
Aliases: CVE-2021-41228
Severity: HIGH
CWE: CWE-78, CWE-94
Published: 2021-11-10T16:54:02Z

### Impact
TensorFlow's `saved_model_cli` tool is vulnerable to a code injection as it [calls `eval` on user supplied strings](https://github.com/tensorflow/tensorflow/blob/87462bfac761435a46641ff2f10ad0b6e5414a4b/tensorflow/python/tools/saved_model_cli.py#L524-L550)
  
```python
def preprocess_input_exprs_arg_string(input_exprs_str):
  ... 
  for input_raw in filter(bool, input_exprs_str.split(';')):
    ...
    input_key, expr = input_raw.split('=', 1)
    input_dict[input_key] = eval(expr)
  ...
``` 
  
This can be used by attackers to run arbitrary code on the plaform where the CLI tool runs.

However, given that the tool is always run manually, the impact of this is not severe. We have patched this by adding a `safe` flag which defaults to `True` and an explicit warning for users.

### Patches
We have patched the issue in GitHub commit [8b202f08d52e8206af2bdb2112a62fafbc546ec7](https://github.com/tensorflow/tensorflow/commit/8b202f08d52e8206af2bdb2112a62fafbc546ec7).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Omer Kaspi from Vdoo.
Vulnerability: PYSEC-2017-30
Aliases: CVE-2015-1839
Published: 2017-04-13T14:59:00Z

modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.
Vulnerability: GHSA-p7xc-35m8-57pr
Summary: FedMsg not properly completing message validation
Aliases: CVE-2017-1000001
Severity: HIGH
CWE: CWE-20
Published: 2018-07-13T15:17:14Z

FedMsg 0.18.1 and older is vulnerable to a message validation flaw resulting in message validation not being enabled if configured to be on.
Vulnerability: PYSEC-2020-258
Aliases: GHSA-977j-xj7q-2jr9, CVE-2020-5215
Published: 2020-01-28T22:15:00Z

In TensorFlow before 1.15.2 and 2.0.1, converting a string (from Python) to a tf.float16 value results in a segmentation fault in eager mode as the format checks for this use case are only in the graph mode. This issue can lead to denial of service in inference/training where a malicious attacker can send a data point which contains a string instead of a tf.float16 value. Similar effects can be obtained by manipulating saved models and checkpoints whereby replacing a scalar tf.float16 value with a scalar string will trigger this issue due to automatic conversions. This can be easily reproduced by tf.constant("hello", tf.float16), if eager execution is enabled. This issue is patched in TensorFlow 1.15.1 and 2.0.1 with this vulnerability patched. TensorFlow 2.1.0 was released after we fixed the issue, thus it is not affected. Users are encouraged to switch to TensorFlow 1.15.1, 2.0.1 or 2.1.0.
Vulnerability: PYSEC-2021-608
Aliases: GHSA-2p25-55c9-h58q, CVE-2021-41198
Published: 2021-11-05T20:15:00Z

TensorFlow is an open source platform for machine learning. In affected versions if `tf.tile` is called with a large input argument then the TensorFlow process will crash due to a `CHECK`-failure caused by an overflow. The number of elements in the output tensor is too much for the `int64_t` type and the overflow is detected via a `CHECK` statement. This aborts the process. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Vulnerability: GHSA-fvq6-392h-6mjj
Summary: Out-of-bounds Read in OpenCV 
Aliases: CVE-2017-12599
Severity: HIGH
CWE: CWE-125
Published: 2021-10-12T22:01:08Z

OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python 3.3.0.9) has an out-of-bounds read error in the function icvCvt_BGRA2BGR_8u_C4C3R when reading an image file by using cv::imread.
Vulnerability: PYSEC-2021-47
Aliases: GHSA-5jqp-qgf6-3pvh, CVE-2021-29510
Published: 2021-05-13T19:15:00Z

Pydantic is a data validation and settings management using Python type hinting. In affected versions passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
Vulnerability: GHSA-xv8x-pr4h-73jv
Summary: Memory corruption when returning a literal struct with a private call inside of it
Aliases: CVE-2021-41121
Severity: HIGH
CWE: CWE-119
Published: 2021-10-12T15:59:29Z

### Impact

When performing a function call inside a literal struct, there is a memory corruption issue that occurs because of an incorrect pointer to the the top of the stack.

### Patches
0.3.0 / #2447

*
Vulnerability: PYSEC-2021-258
Aliases: CVE-2021-37636, GHSA-hp4c-x6r7-6555
Published: 2021-08-12T18:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.SparseDenseCwiseDiv` is vulnerable to a division by 0 error. The [implementation](https://github.com/tensorflow/tensorflow/blob/a1bc56203f21a5a4995311825ffaba7a670d7747/tensorflow/core/kernels/sparse_dense_binary_op_shared.cc#L56) uses a common class for all binary operations but fails to treat the division by 0 case separately. We have patched the issue in GitHub commit d9204be9f49520cdaaeb2541d1dc5187b23f31d9. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2014-77
Aliases: CVE-2014-3137
Published: 2014-10-25T22:55:00Z

Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a ; (semi-colon) and a Content-Type that would not be accepted, as demonstrated in YouCompleteMe to execute arbitrary code.
Vulnerability: PYSEC-2021-576
Aliases: GHSA-g25h-jr74-qp5j, CVE-2021-37663
Published: 2021-08-12T23:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions due to incomplete validation in `tf.raw_ops.QuantizeV2`, an attacker can trigger undefined behavior via binding a reference to a null pointer or can access data outside the bounds of heap allocated arrays. The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/quantize_op.cc#L59) has some validation but does not check that `min_range` and `max_range` both have the same non-zero number of elements. If `axis` is provided (i.e., not `-1`), then validation should check that it is a value in range for the rank of `input` tensor and then the lengths of `min_range` and `max_range` inputs match the `axis` dimension of the `input` tensor. We have patched the issue in GitHub commit 6da6620efad397c85493b8f8667b821403516708. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-126
Aliases: CVE-2021-3533
Published: 2021-06-09T12:15:00Z

A flaw was found in Ansible if an ansible user sets ANSIBLE_ASYNC_DIR to a subdirectory of a world writable directory. When this occurs, there is a race condition on the managed machine. A malicious, non-privileged account on the remote machine can exploit the race condition to access the async result data. This flaw affects Ansible Tower 3.7 and Ansible Automation Platform 1.2.
Vulnerability: PYSEC-2018-54
Aliases: GHSA-894g-6j7q-2hx6, CVE-2018-16516
Published: 2018-09-05T14:29:00Z

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL.
Vulnerability: PYSEC-2020-126
Aliases: GHSA-xmq7-7fxm-rr79, CVE-2020-15203
Published: 2020-09-25T19:15:00Z

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the `fill` argument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a `printf` call is constructed. This may result in segmentation fault. The issue is patched in commit 33be22c65d86256e6826666662e40dbdfe70ee83, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
Vulnerability: GHSA-xm2v-8rrw-w9pm
Summary: Division by 0 in `Conv2DBackpropInput`
Aliases: CVE-2021-29525
Severity: LOW
CWE: CWE-369
Published: 2021-05-21T14:21:51Z

### Impact
An attacker can trigger a division by 0 in `tf.raw_ops.Conv2DBackpropInput`:

```python
import tensorflow as tf

input_tensor = tf.constant([52, 1, 1, 5], shape=[4], dtype=tf.int32)
filter_tensor = tf.constant([], shape=[0, 1, 5, 0], dtype=tf.float32)
out_backprop = tf.constant([], shape=[52, 1, 1, 0], dtype=tf.float32)

tf.raw_ops.Conv2DBackpropInput(input_sizes=input_tensor, filter=filter_tensor,
                               out_backprop=out_backprop, strides=[1, 1, 1, 1],
                               use_cudnn_on_gpu=True, padding='SAME',
                               explicit_paddings=[], data_format='NHWC',
                               dilations=[1, 1, 1, 1])
```                 
                    
This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/b40060c9f697b044e3107917c797ba052f4506ab/tensorflow/core/kernels/conv_grad_input_ops.h#L625-L655) does a division by a quantity that is controlled by the caller:

```cc 
  const size_t size_A = output_image_size * dims.out_depth; 
  const size_t size_B = filter_total_size * dims.out_depth;
  const size_t size_C = output_image_size * filter_total_size;
  const size_t work_unit_size = size_A + size_B + size_C;
  ...
  const size_t shard_size =
      use_parallel_contraction ? 1 :
      (target_working_set_size + work_unit_size - 1) / work_unit_size;
```

### Patches
We have patched the issue in GitHub commit [2be2cdf3a123e231b16f766aa0e27d56b4606535](https://github.com/tensorflow/tensorflow/commit/2be2cdf3a123e231b16f766aa0e27d56b4606535).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: PYSEC-2021-825
Aliases: CVE-2021-41218, GHSA-9crf-c6qr-r273
Published: 2021-11-05T22:15:00Z

TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `AllToAll` can be made to execute a division by 0. This occurs whenever the `split_count` argument is 0. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Vulnerability: GHSA-p28m-34f6-967q
Summary: High severity vulnerability that affects pyopenssl
Aliases: CVE-2018-1000807
Severity: HIGH
CWE: CWE-416
Published: 2018-10-10T16:10:38Z

Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on the calling application and if it retains a reference to the memory.. This vulnerability appears to have been fixed in 17.5.0.
Vulnerability: GHSA-x5cp-9pcf-pp3h
Summary: Denial of Service in Tensorflow
Aliases: CVE-2020-15199
Severity: MODERATE
CWE: CWE-20
Published: 2020-09-25T18:28:24Z

### Impact
The `RaggedCountSparseOutput` does not validate that the input arguments form a valid ragged tensor. In particular, there is no validation that the `splits` tensor has the minimum required number of elements. Code uses this quantity to initialize a different data structure:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/count_ops.cc#L241-L244

Since `BatchedMap` is equivalent to a vector, it needs to have at least one element to not be `nullptr`. If user passes a `splits` tensor that is empty or has exactly one element, we get a `SIGABRT` signal raised by the operating system.

### Patches
We have patched the issue in 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and will release a patch release.

We recommend users to upgrade to TensorFlow 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability is a variant of [GHSA-p5f8-gfw5-33w4](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-p5f8-gfw5-33w4)
Vulnerability: GHSA-h98h-8mxr-m8gx
Summary: Out-of-bounds read in TensorFlow possibly causing disclosure of the contents of process memory.
Aliases: CVE-2018-21233
Severity: MODERATE
CWE: CWE-125
Published: 2020-05-13T16:01:35Z

TensorFlow before 1.7.0 has an integer overflow that causes an out-of-bounds read, possibly causing disclosure of the contents of process memory. This occurs in the DecodeBmp feature of the BMP decoder in core/kernels/decode_bmp_op.cc.
Vulnerability: PYSEC-2019-160
Aliases: CVE-2013-5123
Published: 2019-11-05T22:15:00Z

The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.
Vulnerability: PYSEC-2021-433
Aliases: CVE-2021-32061, GHSA-qppg-v75c-r5ff
Published: 2021-11-29T03:15:00Z

S3Scanner before 2.0.2 allows Directory Traversal via a crafted bucket, as demonstrated by a <Key>../ substring in a ListBucketResult element.
Vulnerability: GHSA-545v-42p7-98fq
Summary: Heap out of bounds read in `MaxPoolGradWithArgmax`
Aliases: CVE-2021-29570
Severity: LOW
CWE: CWE-125
Published: 2021-05-21T14:25:25Z

### Impact
The implementation of `tf.raw_ops.MaxPoolGradWithArgmax` can cause reads outside of bounds of heap allocated data if attacker supplies specially crafted inputs:

```python
import tensorflow as tf

input = tf.constant([10.0, 10.0, 10.0], shape=[1, 1, 3, 1], dtype=tf.float32)
grad = tf.constant([10.0, 10.0, 10.0, 10.0], shape=[1, 1, 1, 4], dtype=tf.float32)
argmax = tf.constant([1], shape=[1], dtype=tf.int64)
ksize = [1, 1, 1, 1]
strides = [1, 1, 1, 1]
  
tf.raw_ops.MaxPoolGradWithArgmax(
  input=input, grad=grad, argmax=argmax, ksize=ksize, strides=strides,
  padding='SAME', include_batch_in_index=False)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/ef0c008ee84bad91ec6725ddc42091e19a30cf0e/tensorflow/core/kernels/maxpooling_op.cc#L1016-L1017) uses the same value to index in two different arrays but there is no guarantee that the sizes are identical. 

### Patches
We have patched the issue in GitHub commit [dcd7867de0fea4b72a2b34bd41eb74548dc23886](https://github.com/tensorflow/tensorflow/commit/dcd7867de0fea4b72a2b34bd41eb74548dc23886).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions. 

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: PYSEC-2020-9
Aliases: CVE-2020-1737, GHSA-893h-35v4-mxqx
Published: 2020-03-09T16:15:00Z

A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.
Vulnerability: PYSEC-2014-98
Aliases: CVE-2014-2260
Published: 2014-04-30T23:58:00Z

Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via the command field in the Cron functionality.
Vulnerability: PYSEC-2021-599
Aliases: CVE-2021-37686, GHSA-mhhc-q96p-mfm9
Published: 2021-08-12T22:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the strided slice implementation in TFLite has a logic bug which can allow an attacker to trigger an infinite loop. This arises from newly introduced support for [ellipsis in axis definition](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/strided_slice.cc#L103-L122). An attacker can craft a model such that `ellipsis_end_idx` is smaller than `i` (e.g., always negative). In this case, the inner loop does not increase `i` and the `continue` statement causes execution to skip over the preincrement at the end of the outer loop. We have patched the issue in GitHub commit dfa22b348b70bb89d6d6ec0ff53973bacb4f4695. TensorFlow 2.6.0 is the only affected version.
Vulnerability: PYSEC-2017-67
Aliases: CVE-2016-10127
Published: 2017-03-03T15:59:00Z

PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.
Vulnerability: PYSEC-2019-79
Aliases: GHSA-7rp2-fm2h-wchj, CVE-2019-12308
Published: 2019-06-03T17:29:00Z

An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.
Vulnerability: GHSA-m6xf-fq7q-8743
Summary: mutation XSS via whitelisted math or svg and raw tag in Bleach
Aliases: CVE-2020-6816
Severity: MODERATE
CWE: CWE-79
Published: 2020-03-24T15:06:32Z

### Impact

A [mutation XSS](https://cure53.de/fp170.pdf) affects users calling `bleach.clean` with all of:

* the `svg` or `math` in the allowed/whitelisted tags
* an RCDATA tag (see below) in the allowed/whitelisted tags
* the keyword argument `strip=False`

### Patches

Users are encouraged to upgrade to bleach v3.1.2 or greater.

### Workarounds

* modify `bleach.clean` calls to use `strip=True`, or not whitelist `math` or `svg` tags and one or more of the following tags:

```
script
noscript
style
noframes
xmp
noembed
iframe
```

* A strong [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) without `unsafe-inline` and `unsafe-eval` [`script-src`s](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)) will also help mitigate the risk.

### References

* https://bugzilla.mozilla.org/show_bug.cgi?id=1621692
* https://cure53.de/fp170.pdf
* https://nvd.nist.gov/vuln/detail/CVE-2020-6816
* https://www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleach

### Credits

* Reported by [Yaniv Nizry](https://twitter.com/ynizry) from the CxSCA AppSec group at Checkmarx

### For more information

If you have any questions or comments about this advisory:

* Open an issue at [https://github.com/mozilla/bleach/issues](https://github.com/mozilla/bleach/issues)
* Email us at [security@mozilla.org](mailto:security@mozilla.org)
Vulnerability: PYSEC-2013-24
Aliases: CVE-2013-2013
Published: 2013-10-01T20:55:00Z

The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows local users to obtain sensitive information by listing the process.
Vulnerability: PYSEC-2011-19
Aliases: GHSA-6h52-4vmh-8x4f, CVE-2011-1156
Published: 2011-04-11T18:55:00Z

feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) before 5.0.1 allows remote attackers to cause a denial of service (application crash) via a malformed DOCTYPE declaration.
Vulnerability: GHSA-h9px-9vqg-222h
Summary: Heap OOB in `QuantizeAndDequantizeV3`
Aliases: CVE-2021-29553
Severity: LOW
CWE: CWE-125
Published: 2021-05-21T14:23:51Z

### Impact
An attacker can read data outside of bounds of heap allocated buffer in `tf.raw_ops.QuantizeAndDequantizeV3`:

```python
import tensorflow as tf

tf.raw_ops.QuantizeAndDequantizeV3(
  input=[2.5,2.5], input_min=[0,0], input_max=[1,1], num_bits=[30],
  signed_input=False, range_given=False, narrow_range=False, axis=3)
```   

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/11ff7f80667e6490d7b5174aa6bf5e01886e770f/tensorflow/core/kernels/quantize_and_dequantize_op.cc#L237) does not validate the value of user supplied `axis` attribute before using it to index in the array backing the `input` argument:

```cc
const int depth = (axis_ == -1) ? 1 : input.dim_size(axis_);
```

### Patches
We have patched the issue in GitHub commit [99085e8ff02c3763a0ec2263e44daec416f6a387](https://github.com/tensorflow/tensorflow/commit/99085e8ff02c3763a0ec2263e44daec416f6a387).
  
The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Aivul Team from Qihoo 360.
Vulnerability: PYSEC-2021-10
Aliases: CVE-2021-30459, GHSA-pghf-347x-c2gj
Published: 2021-04-14T18:15:00Z

A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL statements by changing the raw_sql input field of the SQL explain, analyze, or select form.
Vulnerability: PYSEC-2017-88
Aliases: CVE-2017-1000115
Published: 2017-10-05T01:29:00Z

Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository
Vulnerability: PYSEC-2010-22
Aliases: CVE-2007-6738
Published: 2010-10-19T20:00:00Z

pyftpdlib before 0.1.1 does not choose a random value for the port associated with the PASV command, which makes it easier for remote attackers to obtain potentially sensitive information about the number of in-progress data connections by reading the response to this command.
Vulnerability: PYSEC-2021-833
Aliases: CVE-2021-41226, GHSA-374m-jm66-3vj8
Published: 2021-11-05T21:15:00Z

TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SparseBinCount` is vulnerable to a heap OOB access. This is because of missing validation between the elements of the `values` argument and the shape of the sparse output. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2020-130
Aliases: CVE-2020-15207, GHSA-q4qf-3fc6-8x34
Published: 2020-09-25T19:15:00Z

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, to mimic Python's indexing with negative values, TFLite uses `ResolveAxis` to convert negative values to positive indices. However, the only check that the converted index is now valid is only present in debug builds. If the `DCHECK` does not trigger, then code execution moves ahead with a negative index. This, in turn, results in accessing data out of bounds which results in segfaults and/or data corruption. The issue is patched in commit 2d88f470dea2671b430884260f3626b1fe99830a, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
Vulnerability: PYSEC-2018-42
Aliases: GHSA-jwcc-j78w-j73w, CVE-2018-10855
Published: 2018-07-03T01:29:00Z

Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.
Vulnerability: PYSEC-2019-199
Aliases: GHSA-r6v3-hpxj-r8rv, SNYK-PYTHON-PYXDG-174562, CVE-2019-12761
Published: 2019-06-06T19:29:00Z

A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This is due to a lack of sanitization in xdg/Menu.py before an eval call.
Vulnerability: PYSEC-2021-130
Aliases: CVE-2021-32797, GHSA-4952-p58q-6crx
Published: 2021-08-09T21:15:00Z

JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html `<form>`. Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook.
Vulnerability: GHSA-vw27-fwjf-5qxm
Summary: Arbitrary command execution on Windows via qutebrowserurl: URL handler
Aliases: CVE-2021-41146
Severity: HIGH
CWE: CWE-77, CWE-641, CWE-88
Published: 2021-10-22T16:20:10Z

### Impact
Starting with qutebrowser v1.7.0, the Windows installer for qutebrowser registers it as a handler for certain URL schemes. With some applications such as Outlook Desktop, opening a specially crafted URL can lead to argument injection, allowing execution of qutebrowser commands, which in turn allows arbitrary code execution via commands such as `:spawn` or `:debug-pyeval`.

Only Windows installs where qutebrowser is registered as URL handler are affected. It does *not* have to be set as default browser for the exploit to work.

### Patches
The issue has been fixed in [qutebrowser v2.4.0](https://github.com/qutebrowser/qutebrowser/releases/tag/v2.4.0) in commit 8f46ba3f6dc7b18375f7aa63c48a1fe461190430.

The fix also adds additional hardening for potential similar issues on Linux (by adding the new `--untrusted-args` flag to the `.desktop` file), though no such vulnerabilities are known.

Backported patches for older versions are available, but no further releases are planned:

- v1.7.x: d1ceaab
- v1.8.x: ca7155d
- v1.9.x: 157d871
- v1.10.x: 94a6125
- v1.11.x: 10acfbb
- v1.12.x: 363a18f
- v1.13.x: 410f262
- v1.14.x: e4f4d93
- v2.0.x: 15a1654
- v2.1.x: 509ddf2
- v2.2.x: 03dcba5
- v2.3.x: 00a694c

(commits are referring to qutebrowser/qutebrowser on GitHub)

### Workarounds
Remove qutebrowser from the default browser settings entirely, so that it does not handle any kind of URLs. Make sure to remove *all* handlers, including an (accidental) `qutebrowserURL` handler, e.g. using [NirSoft URLProtocolView](https://www.nirsoft.net/utils/url_protocol_view.html).

### Timeline
2021-10-15: Issue reported via security@qutebrowser.org by Ping Fan (Zetta) Ke of [Valkyrie-X Security Research Group (VXRL)](https://www.vxrl.hk/)
2021-10-15: Issue confirmed by @The-Compiler (lead developer), author of installer (@bitraid) contacted for help/review
2021-10-15: CVE assigned by GitHub
2021-10-15 to 2021-10-17: Fix developed
2021-10-17: Additional core developer (@toofar) contacted for help/review
2021-10-21: v2.4.0 released containing the fix
2021-10-21: Advisory and fix published

### References
See the [commit message](https://github.com/qutebrowser/qutebrowser/commit/8f46ba3f6dc7b18375f7aa63c48a1fe461190430) for additional information and references to various similar issues in other projects.

### Acknowledgements
Thanks to Ping Fan (Zetta) Ke of [Valkyrie-X Security Research Group](https://www.vxrl.hk/) (VXRL/@vxresearch) for finding and responsibly disclosing this issue.

### Contact
If you have any questions or comments about this advisory, please email [security@qutebrowser.org](mailto:security@qutebrowser.org).
Vulnerability: GHSA-c968-pq7h-7fxv
Summary: Division by 0 in `Conv3DBackprop*`
Aliases: CVE-2021-29522
Severity: LOW
CWE: CWE-369
Published: 2021-05-21T14:21:39Z

### Impact
The `tf.raw_ops.Conv3DBackprop*` operations fail to validate that the input tensors are not empty. In turn, this would result in a division by 0:

```python
import tensorflow as tf

input_sizes = tf.constant([0, 0, 0, 0, 0], shape=[5], dtype=tf.int32)
filter_tensor = tf.constant([], shape=[0, 0, 0, 1, 0], dtype=tf.float32)
out_backprop = tf.constant([], shape=[0, 0, 0, 0, 0], dtype=tf.float32)
                            
tf.raw_ops.Conv3DBackpropInputV2(input_sizes=input_sizes, filter=filter_tensor, out_backprop=out_backprop, strides=[1, 1, 1, 1, 1], padding='SAME', data_format='NDHWC', dilations=[1, 1, 1, 1, 1])
```
```python
import tensorflow as tf

input_sizes = tf.constant([1], shape=[1, 1, 1, 1, 1], dtype=tf.float32)
filter_tensor = tf.constant([0, 0, 0, 1, 0], shape=[5], dtype=tf.int32)
out_backprop = tf.constant([], shape=[1, 1, 1, 1, 0], dtype=tf.float32)

tf.raw_ops.Conv3DBackpropFilterV2(input=input_sizes, filter_sizes=filter_tensor, out_backprop=out_backprop, strides=[1, 1, 1, 1, 1], padding='SAME', data_format='NDHWC', dilations=[1, 1, 1, 1, 1])
```

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/a91bb59769f19146d5a0c20060244378e878f140/tensorflow/core/kernels/conv_grad_ops_3d.cc#L430-L450) does not check that the divisor used in computing the shard size is not zero:

```cc
  const int64 size_A = output_image_size * dims.out_depth;
  const int64 size_B = filter_total_size * dims.out_depth;
  const int64 size_C = output_image_size * filter_total_size;
  const int64 work_unit_size = size_A + size_B + size_C;
  ...
  const size_t shard_size =
      use_parallel_contraction
        ? 1
        : (target_working_set_size + work_unit_size - 1) / work_unit_size;
```

Thus, if attacker controls the input sizes, they can trigger a denial of service via a division by zero error.

### Patches
We have patched the issue in GitHub commit [311403edbc9816df80274bd1ea8b3c0c0f22c3fa](https://github.com/tensorflow/tensorflow/commit/311403edbc9816df80274bd1ea8b3c0c0f22c3fa).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: PYSEC-2021-560
Aliases: GHSA-c5x2-p679-95wc, CVE-2021-37647
Published: 2021-08-12T19:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. When a user does not supply arguments that determine a valid sparse tensor, `tf.raw_ops.SparseTensorSliceDataset` implementation can be made to dereference a null pointer. The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/data/sparse_tensor_slice_dataset_op.cc#L240-L251) has some argument validation but fails to consider the case when either `indices` or `values` are provided for an empty sparse tensor when the other is not. If `indices` is empty, then [code that performs validation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/data/sparse_tensor_slice_dataset_op.cc#L260-L261) (i.e., checking that the indices are monotonically increasing) results in a null pointer dereference. If `indices` as provided by the user is empty, then `indices` in the C++ code above is backed by an empty `std::vector`, hence calling `indices->dim_size(0)` results in null pointer dereferencing (same as calling `std::vector::at()` on an empty vector). We have patched the issue in GitHub commit 02cc160e29d20631de3859c6653184e3f876b9d7. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2014-61
Aliases: CVE-2013-4197
Published: 2014-03-11T19:37:00Z

member_portrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to modify or delete portraits of other users via unspecified vectors.
Vulnerability: PYSEC-2022-139
Aliases: CVE-2022-23575, GHSA-c94w-c95p-phf8
Published: 2022-02-04T23:15:00Z

Tensorflow is an Open Source Machine Learning Framework. The implementation of `OpLevelCostEstimator::CalculateTensorSize` is vulnerable to an integer overflow if an attacker can create an operation which would involve a tensor with large enough number of elements. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-425
Aliases: CVE-2021-39164, GHSA-3x4c-pq33-4w3q
Published: 2021-08-31T17:15:00Z

Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with `shared` history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. One workaround is available. Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the endpoints: `/_matrix/client/r0/rooms/{room_id}/members` with `at` query parameter, and `/_matrix/client/unstable/rooms/{room_id}/members` with `at` query parameter.
Vulnerability: GHSA-c7pr-343r-5c46
Summary: missing clamps for decimal args in external functions
Aliases: CVE-2021-41122
Severity: MODERATE
CWE: CWE-682
Published: 2021-10-06T17:48:46Z

### Impact

The following code does not properly validate that its input is in bounds.

```python
@external
def foo(x: decimal) -> decimal:
    return x
```

### Patches
0.3.0 / #2447

### Workarounds
Don't use decimal args
Vulnerability: PYSEC-2022-16
Aliases: CVE-2022-21697, GHSA-gcv9-6737-pjqw
Published: 2022-01-25T14:15:00Z

Jupyter Server Proxy is a Jupyter notebook server extension to proxy web services. Versions of Jupyter Server Proxy prior to 3.2.1 are vulnerable to Server-Side Request Forgery (SSRF). Any user deploying Jupyter Server or Notebook with jupyter-proxy-server extension enabled is affected. A lack of input validation allows authenticated clients to proxy requests to other hosts, bypassing the `allowed_hosts` check. Because authentication is required, which already grants permissions to make the same requests via kernel or terminal execution, this is considered low to moderate severity. Users may upgrade to version 3.2.1 to receive a patch or, as a workaround, install the patch manually.
Vulnerability: PYSEC-2019-176
Aliases: CVE-2009-5042, GHSA-cg75-6938-wx58
Published: 2019-10-31T16:15:00Z

python-docutils allows insecure usage of temporary files
Vulnerability: GHSA-267x-w5hx-8hjr
Summary: Integer Overflow or Wraparound in OpenCV
Aliases: CVE-2017-12864
Severity: HIGH
CWE: CWE-190
Published: 2021-10-12T22:02:45Z

In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function ReadNumber did not checkout the input length, which lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects OpenCV 3.3 (corresponding with OpenCV-Python version 3.3.0.9) and earlier.
Vulnerability: PYSEC-2013-32
Aliases: CVE-2013-2217
Published: 2013-09-23T20:55:00Z

cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.
Vulnerability: GHSA-xqfj-cr6q-pc8w
Summary: Crash in `tf.transpose` with complex inputs
Aliases: CVE-2021-29618
Severity: LOW
CWE: CWE-755
Published: 2021-05-21T14:28:58Z

### Impact
Passing a complex argument to `tf.transpose` at the same time as passing `conjugate=True` argument results in a crash:

```python 
import tensorflow as tf
tf.transpose(conjugate=True, a=complex(1))
```

### Patches
We have received a patch for the issue in GitHub commit [1dc6a7ce6e0b3e27a7ae650bfc05b195ca793f88](https://github.com/tensorflow/tensorflow/commit/1dc6a7ce6e0b3e27a7ae650bfc05b195ca793f88).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported in [#42105](https://github.com/tensorflow/issues/42105) and fixed in [#46973](https://github.com/tensorflow/issues/46973).
Vulnerability: PYSEC-2017-71
Aliases: CVE-2015-6941
Published: 2017-08-09T16:29:00Z

win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs.
Vulnerability: GHSA-cpqf-3c3r-c9g2
Summary: Cobbler before 3.3.0 allows log poisoning
Aliases: CVE-2021-40323
Severity: HIGH
CWE: CWE-94
Published: 2021-10-05T17:53:20Z

Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.
Vulnerability: PYSEC-2020-219
Aliases: GHSA-9gjv-6qq6-v7qm, CVE-2020-5240
Published: 2020-03-13T22:15:00Z

In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially compromise the account if they figure out their password. The problem has been patched in version 1.4.1.
Vulnerability: PYSEC-2021-649
Aliases: GHSA-2cpx-427x-q2c6, CVE-2021-29523
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a denial of service via a `CHECK`-fail in `tf.raw_ops.AddManySparseToTensorsMap`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/6f9896890c4c703ae0a0845394086e2e1e523299/tensorflow/core/kernels/sparse_tensors_map_ops.cc#L257) takes the values specified in `sparse_shape` as dimensions for the output shape. The `TensorShape` constructor(https://github.com/tensorflow/tensorflow/blob/6f9896890c4c703ae0a0845394086e2e1e523299/tensorflow/core/framework/tensor_shape.cc#L183-L188) uses a `CHECK` operation which triggers when `InitDims`(https://github.com/tensorflow/tensorflow/blob/6f9896890c4c703ae0a0845394086e2e1e523299/tensorflow/core/framework/tensor_shape.cc#L212-L296) returns a non-OK status. This is a legacy implementation of the constructor and operations should use `BuildTensorShapeBase` or `AddDimWithStatus` to prevent `CHECK`-failures in the presence of overflows. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-219
Aliases: GHSA-c45w-2wxr-pp53, CVE-2021-29582
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. Due to lack of validation in `tf.raw_ops.Dequantize`, an attacker can trigger a read from outside of bounds of heap allocated data. The implementation(https://github.com/tensorflow/tensorflow/blob/26003593aa94b1742f34dc22ce88a1e17776a67d/tensorflow/core/kernels/dequantize_op.cc#L106-L131) accesses the `min_range` and `max_range` tensors in parallel but fails to check that they have the same shape. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.