TQRG/raw-osv-data huggingface dataset:
Vulnerability: PYSEC-2021-760
Aliases: CVE-2021-37649, GHSA-6gv8-p3vj-pxvr
Published: 2021-08-12T19:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. The code for `tf.raw_ops.UncompressElement` can be made to trigger a null pointer dereference. The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/data/experimental/compression_ops.cc#L50-L53) obtains a pointer to a `CompressedElement` from a `Variant` tensor and then proceeds to dereference it for decompressing. There is no check that the `Variant` tensor contained a `CompressedElement`, so the pointer is actually `nullptr`. We have patched the issue in GitHub commit 7bdf50bb4f5c54a4997c379092888546c97c3ebd. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Vulnerability: GHSA-g5j6-r3x9-gf2m
Summary: Cross-site scripting in Contentful
Aliases: CVE-2020-13258
Severity: MODERATE
CWE: CWE-79
Published: 2021-06-18T18:32:20Z

Contentful through 2020-05-21 for Python allows reflected XSS, as demonstrated by the api parameter to the-example-app.py.
Vulnerability: PYSEC-2020-47
Aliases: GHSA-3gw4-m5w7-v89c, CVE-2020-11090
Published: 2020-06-11T00:15:00Z

In Indy Node 1.12.2, there is an Uncontrolled Resource Consumption vulnerability. Indy Node has a bug in TAA handling code. The current primary can be crashed with a malformed transaction from a client, which leads to a view change. Repeated rapid view changes have the potential of bringing down the network. This is fixed in version 1.12.3.
Vulnerability: PYSEC-2021-449
Aliases: CVE-2021-29521, GHSA-hr84-fqvp-48mm
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. Specifying a negative dense shape in `tf.raw_ops.SparseCountSparseOutput` results in a segmentation fault being thrown out from the standard library as `std::vector` invariants are broken. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/8f7b60ee8c0206a2c99802e3a4d1bb55d2bc0624/tensorflow/core/kernels/count_ops.cc#L199-L213) assumes the first element of the dense shape is always positive and uses it to initialize a `BatchedMap<T>` (i.e., `std::vector<absl::flat_hash_map<int64,T>>`(https://github.com/tensorflow/tensorflow/blob/8f7b60ee8c0206a2c99802e3a4d1bb55d2bc0624/tensorflow/core/kernels/count_ops.cc#L27)) data structure. If the `shape` tensor has more than one element, `num_batches` is the first value in `shape`. Ensuring that the `dense_shape` argument is a valid tensor shape (that is, all elements are non-negative) solves this issue. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 and TensorFlow 2.3.3.
Vulnerability: PYSEC-2022-155
Aliases: CVE-2022-23591, GHSA-247x-2f9f-5wp7
Published: 2022-02-04T23:15:00Z

Tensorflow is an Open Source Machine Learning Framework. The `GraphDef` format in TensorFlow does not allow self recursive functions. The runtime assumes that this invariant is satisfied. However, a `GraphDef` containing a fragment such as the following can be consumed when loading a `SavedModel`. This would result in a stack overflow during execution as resolving each `NodeDef` means resolving the function itself and its nodes. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Vulnerability: PYSEC-2016-30
Aliases: CVE-2016-7146
Published: 2016-11-10T17:59:00Z

MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation or crafted URL" approach, related to a "Cross Site Scripting (XSS)" issue affecting the action=fckdialog&dialog=attachment (via page name) component.
Vulnerability: GHSA-m648-33qf-v3gp
Summary: CHECK-fail in LSTM with zero-length input in TensorFlow
Aliases: CVE-2020-26270
Severity: LOW
CWE: CWE-20
Published: 2020-12-10T19:07:31Z

### Impact
Running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a `CHECK` failure when using the CUDA backend.

This can result in a query-of-death vulnerability, via denial of service, if users can control the input to the layer.

### Patches
We have patched the issue in GitHub commit [14755416e364f17fb1870882fa778c7fec7f16e3](https://github.com/tensorflow/tensorflow/commit/14755416e364f17fb1870882fa778c7fec7f16e3) and will release TensorFlow 2.4.0 containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.

Since this issue also impacts TF versions before 2.4, we will patch all releases between 1.15 and 2.3 inclusive.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-gh6x-4whr-2qv4
Summary: Null pointer dereference and heap OOB read in operations restoring tensors
Aliases: CVE-2021-37639
Severity: HIGH
CWE: CWE-476, CWE-125
Published: 2021-08-25T14:44:05Z

### Impact
When restoring tensors via raw APIs, if the tensor name is not provided, TensorFlow can be tricked into dereferencing a null pointer:

```python
import tensorflow as tf

tf.raw_ops.Restore(
  file_pattern=['/tmp'],
  tensor_name=[], 
  default_value=21,
  dt=tf.int,
  preferred_shard=1)
```
  
The same undefined behavior can be triggered by `tf.raw_ops.RestoreSlice`:
  
```python
import tensorflow as tf

tf.raw_ops.RestoreSlice(
  file_pattern=['/tmp'],
  tensor_name=[], 
  shape_and_slice='2',
  dt=inp.array([tf.int]),
  preferred_shard=1)
```

Alternatively, attackers can read memory outside the bounds of heap allocated data by providing some tensor names but not enough for a successful restoration:

```python
import tensorflow as tf

tf.raw_ops.Restore(
  file_pattern=['/tmp'],
  tensor_name=['x'], 
  default_value=21,
  dt=tf.int,
  preferred_shard=42)
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/47a06f40411a69c99f381495f490536972152ac0/tensorflow/core/kernels/save_restore_tensor.cc#L158-L159) retrieves the tensor list corresponding to the `tensor_name` user controlled input and immediately retrieves the tensor at the restoration index (controlled via `preferred_shard` argument). This occurs without validating that the provided list has enough values.

If the list is empty this results in dereferencing a null pointer (undefined behavior). If, however, the list has some elements, if the restoration index is outside the bounds this results in heap OOB read.

### Patches 
We have patched the issue in GitHub commit [9e82dce6e6bd1f36a57e08fa85af213e2b2f2622](https://github.com/tensorflow/tensorflow/commit/9e82dce6e6bd1f36a57e08fa85af213e2b2f2622).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information 
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-gfv6-cj92-g3hx
Summary: Moderate severity vulnerability that affects pykmip
Aliases: CVE-2018-1000872
Severity: MODERATE
CWE: CWE-400
Published: 2018-12-21T17:46:39Z

OpenKMIP PyKMIP version All versions before 0.8.0 contains a CWE 399: Resource Management Errors (similar issue to CVE-2015-5262) vulnerability in PyKMIP server that can result in DOS: the server can be made unavailable by one or more clients opening all of the available sockets. This attack appear to be exploitable via A client or clients open sockets with the server and then never close them. This vulnerability appears to have been fixed in 0.8.0.
Vulnerability: PYSEC-2022-95
Aliases: CVE-2022-23586, GHSA-43jf-985q-588j
Published: 2022-02-04T23:15:00Z

Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a `SavedModel` such that assertions in `function.cc` would be falsified and crash the Python interpreter. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Vulnerability: GHSA-4vf2-4xcg-65cx
Summary: Division by 0 in `Conv2D`
Aliases: CVE-2021-29526
Severity: LOW
CWE: CWE-369
Published: 2021-05-21T14:21:55Z

### Impact
An attacker can trigger a division by 0 in `tf.raw_ops.Conv2D`:

```python
import tensorflow as tf

input = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.float32)
filter = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.float32)

strides = [1, 1, 1, 1]
padding = "SAME"
                               
tf.raw_ops.Conv2D(input=input, filter=filter, strides=strides, padding=padding)
```                            
                               
This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/988087bd83f144af14087fe4fecee2d250d93737/tensorflow/core/kernels/conv_ops.cc#L261-L263) does a division by a quantity that is controlled by the caller:
```cc
  const int64 patch_depth = filter.dim_size(2);
  if (in_depth % patch_depth != 0) { ... }
```
  
### Patches
We have patched the issue in GitHub commit [b12aa1d44352de21d1a6faaf04172d8c2508b42b](https://github.com/tensorflow/tensorflow/commit/b12aa1d44352de21d1a6faaf04172d8c2508b42b).
  
The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution 
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: PYSEC-2008-8
Aliases: CVE-2008-0299
Published: 2008-01-16T23:00:00Z

common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session to obtain sensitive information from another session by predicting the state of the pool.
Vulnerability: PYSEC-2020-263
Aliases: GHSA-fx83-3ph3-9j2q, CVE-2020-25626
Published: 2020-09-30T20:15:00Z

A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.
Vulnerability: PYSEC-2021-633
Aliases: GHSA-rg3m-hqc5-344v, CVE-2021-41224
Published: 2021-11-05T21:15:00Z

TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SparseFillEmptyRows` can be made to trigger a heap OOB access. This occurs whenever the size of `indices` does not match the size of `values`. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Vulnerability: GHSA-j8j8-348v-wfm3
Summary: High severity vulnerability that affects python-saml
Aliases: CVE-2017-11427
Severity: HIGH
CWE: CWE-287
Published: 2019-07-05T21:11:26Z

OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
Vulnerability: PYSEC-2022-9
Aliases: CVE-2022-22816, GHSA-xrcv-f9gm-v42c
Published: 2022-01-10T14:12:00Z

path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.
Vulnerability: PYSEC-2021-263
Aliases: CVE-2021-37641, GHSA-9c8h-vvrj-w2p8
Published: 2021-08-12T21:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions if the arguments to `tf.raw_ops.RaggedGather` don't determine a valid ragged tensor code can trigger a read from outside of bounds of heap allocated buffers. The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/ragged_gather_op.cc#L70) directly reads the first dimension of a tensor shape before checking that said tensor has rank of at least 1 (i.e., it is not a scalar). Furthermore, the implementation does not check that the list given by `params_nested_splits` is not an empty list of tensors. We have patched the issue in GitHub commit a2b743f6017d7b97af1fe49087ae15f0ac634373. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-799
Aliases: GHSA-vcjj-9vg7-vf68, CVE-2021-37688
Published: 2021-08-12T22:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service. The [implementation](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/internal/optimized/optimized_ops.h#L268-L285) unconditionally dereferences a pointer. We have patched the issue in GitHub commit 15691e456c7dc9bd6be203b09765b063bf4a380c. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Vulnerability: GHSA-gwr8-5j83-483c
Summary: OS Command Injection and Improper Input Validation in ansible
Aliases: CVE-2019-14904
Severity: HIGH
CWE: CWE-20, CWE-78
Published: 2021-04-20T16:44:22Z

A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and executing arbitrary commands in the remote host. Ansible Engine 2.7.15, 2.8.7, and 2.9.2 as well as previous versions are affected.
Vulnerability: PYSEC-2021-776
Aliases: CVE-2021-37665, GHSA-v82p-hv3v-p6qp
Published: 2021-08-12T23:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions due to incomplete validation in MKL implementation of requantization, an attacker can trigger undefined behavior via binding a reference to a null pointer or can access data outside the bounds of heap allocated arrays. The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/mkl/mkl_requantization_range_per_channel_op.cc) does not validate the dimensions of the `input` tensor. A similar issue occurs in `MklRequantizePerChannelOp`. The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/mkl/mkl_requantize_per_channel_op.cc) does not perform full validation for all the input arguments. We have patched the issue in GitHub commit 9e62869465573cb2d9b5053f1fa02a81fce21d69 and in the Github commit 203214568f5bc237603dbab6e1fd389f1572f5c9. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2019-15
Aliases: CVE-2019-19118, GHSA-hvmf-r92r-27hr
Published: 2019-12-02T14:15:00Z

Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model's save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.)
Vulnerability: PYSEC-2021-326
Aliases: CVE-2021-38540
Published: 2021-09-09T15:15:00Z

The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow >=2.0.0, <2.1.3.
Vulnerability: PYSEC-2021-93
Aliases: CVE-2021-28677, GHSA-q5hq-fp76-qmrc
Published: 2021-06-02T16:15:00Z

An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.
Vulnerability: GHSA-j3jp-gvr5-7hwq
Summary: Low severity vulnerability that affects python-engineio
Aliases: CVE-2019-13611
Severity: HIGH
CWE: CWE-352
Published: 2019-07-30T20:47:25Z

## WebSocket cross-origin vulnerability

### Impact
This is a Cross-Site Request Forgery (CSRF) vulnerability. It affects Socket.IO and Engine.IO web servers that authenticate clients using cookies.

### Patches
python-engineio version 3.9.0 patches this vulnerability by adding server-side Origin header checks.

### Workarounds
Do not use cookies for client authentication, or else add a CSRF token to the connection URL.

### References
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)
https://www.christian-schneider.net/CrossSiteWebSocketHijacking.html

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [python-engineio](http://github.com/miguelgrinberg/python-engineio)
Vulnerability: PYSEC-2020-326
Aliases: GHSA-cvpc-8phh-8f45, CVE-2020-15211
Published: 2020-09-25T19:15:00Z

In TensorFlow Lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, saved models in the flatbuffer format use a double indexing scheme: a model has a set of subgraphs, each subgraph has a set of operators and each operator has a set of input/output tensors. The flatbuffer format uses indices for the tensors, indexing into an array of tensors that is owned by the subgraph. This results in a pattern of double array indexing when trying to get the data of each tensor. However, some operators can have some tensors be optional. To handle this scenario, the flatbuffer model uses a negative `-1` value as index for these tensors. This results in special casing during validation at model loading time. Unfortunately, this means that the `-1` index is a valid tensor index for any operator, including those that don't expect optional inputs and including for output tensors. Thus, this allows writing and reading from outside the bounds of heap allocated arrays, although only at a specific offset from the start of these arrays. This results in both read and write gadgets, albeit very limited in scope. The issue is patched in several commits (46d5b0852, 00302787b7, e11f5558, cd31fd0ce, 1970c21, and fff2c83), and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1. A potential workaround would be to add a custom `Verifier` to the model loading code to ensure that only operators which accept optional inputs use the `-1` special value and only for the tensors that they expect to be optional. Since this allow-list type approach is erro-prone, we advise upgrading to the patched code.
Vulnerability: GHSA-frxj-5j27-f8rf
Summary: Externally Controlled Reference to a Resource in Another Sphere, Improper Input Validation, and External Control of File Name or Path in Ansible
Aliases: CVE-2019-14905
Severity: MODERATE
CWE: CWE-20, CWE-73, CWE-610, CWE-668
Published: 2021-04-20T16:44:49Z

A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues.
Vulnerability: PYSEC-2019-225
Aliases: CVE-2018-7577
Published: 2019-04-24T17:29:00Z

Memcpy parameter overlap in Google Snappy library 1.1.4, as used in Google TensorFlow before 1.7.1, could result in a crash or read from other parts of process memory.
Vulnerability: PYSEC-2022-143
Aliases: GHSA-5f2r-qp73-37mr, CVE-2022-23579
Published: 2022-02-04T23:15:00Z

Tensorflow is an Open Source Machine Learning Framework. The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a `SavedModel` such that `SafeToRemoveIdentity` would trigger `CHECK` failures. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Vulnerability: GHSA-gcv9-6737-pjqw
Summary: SSRF vulnerability in jupyter-server-proxy
Aliases: CVE-2022-21697
Severity: MODERATE
CWE: CWE-918
Published: 2022-01-27T16:24:26Z

### Impact

**What kind of vulnerability is it?**  Server-Side Request Forgery ( SSRF )

**Who is impacted?** Any user deploying Jupyter Server or Notebook with jupyter-proxy-server extension enabled. 

A lack of input validation allowed authenticated clients to proxy requests to other hosts, bypassing the `allowed_hosts` check. Because authentication is required, which already grants permissions to make the same requests via kernel or terminal execution, this is considered low to moderate severity.


### Patches

_Has the problem been patched? What versions should users upgrade to?_

Upgrade to 3.2.1, or apply the patch https://github.com/jupyterhub/jupyter-server-proxy/compare/v3.2.0...v3.2.1.patch

### For more information

If you have any questions or comments about this advisory:

* Open a topic [on our forum](https://discourse.jupyter.org)
* Email the Jupyter security team at [security@ipython.org](mailto:security@ipython.org)
Vulnerability: GHSA-gh8j-2pgf-x458
Summary: Infinite Loop in rencode
Aliases: CVE-2021-40839
Severity: HIGH
CWE: CWE-835
Published: 2021-09-13T20:05:51Z

The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\x2f\x7f), enabling a remote attack that consumes CPU and memory.
Vulnerability: PYSEC-2020-51
Aliases: GHSA-v7m9-9497-p9gr, CVE-2020-15110
Published: 2020-07-17T21:15:00Z

In jupyterhub-kubespawner before 0.12, certain usernames will be able to craft particular server names which will grant them access to the default server of other users who have matching usernames. This has been fixed in 0.12.
Vulnerability: PYSEC-2021-849
Aliases: GHSA-x95h-979x-cf3j, CVE-2021-42576
Published: 2021-10-18T15:15:00Z

The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.
Vulnerability: PYSEC-2022-83
Aliases: GHSA-77gp-3h4r-6428, CVE-2022-23574
Published: 2022-02-04T23:15:00Z

Tensorflow is an Open Source Machine Learning Framework. There is a typo in TensorFlow's `SpecializeType` which results in heap OOB read/write. Due to a typo, `arg` is initialized to the `i`th mutable argument in a loop where the loop index is `j`. Hence it is possible to assign to `arg` from outside the vector of arguments. Since this is a mutable proto value, it allows both read and write to outside of bounds data. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.
Vulnerability: PYSEC-2018-38
Aliases: CVE-2016-8628, GHSA-jg4f-jqm5-4mgq
Published: 2018-07-31T20:29:00Z

Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.
Vulnerability: GHSA-h56g-v4vp-q9q6
Summary: Cross-site Scripting in calibreweb
Aliases: CVE-2022-0352
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-29T00:00:41Z

calibreweb prior to version 0.6.16 contains a cross-site scripting vulnerability.
Vulnerability: PYSEC-2016-26
Aliases: CVE-2016-3068
Published: 2016-04-13T16:59:00Z

Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository.
Vulnerability: PYSEC-2021-234
Aliases: GHSA-v52p-hfjf-wg88, CVE-2021-29597
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. The implementation of the `SpaceToBatchNd` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/412c7d9bb8f8a762c5b266c9e73bfa165f29aac8/tensorflow/lite/kernels/space_to_batch_nd.cc#L82-L83). An attacker can craft a model such that one dimension of the `block` input is 0. Hence, the corresponding value in `block_shape` is 0. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: GHSA-p6h9-hpcg-c6gm
Summary: High severity vulnerability that affects Plone and Zope2
Aliases: CVE-2011-2528
Severity: HIGH
Published: 2018-07-23T19:52:02Z

Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix20110720 for Plone 3.x allows attackers to gain privileges via unspecified vectors, related to a "highly serious vulnerability." NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-0720.
Vulnerability: PYSEC-2021-664
Aliases: GHSA-j8qc-5fqr-52fp, CVE-2021-29538
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a division by zero to occur in `Conv2DBackpropFilter`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/1b0296c3b8dd9bd948f924aa8cd62f87dbb7c3da/tensorflow/core/kernels/conv_grad_filter_ops.cc#L513-L522) computes a divisor based on user provided data (i.e., the shape of the tensors given as arguments). If all shapes are empty then `work_unit_size` is 0. Since there is no check for this case before division, this results in a runtime exception, with potential to be abused for a denial of service. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2020-234
Aliases: GHSA-grfj-wjv9-4f9v, CVE-2020-26232
Published: 2020-11-24T21:15:00Z

Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A maliciously crafted link to a jupyter server could redirect the browser to a different website. All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet.
Vulnerability: GHSA-jc87-6vpp-7ff3
Summary: Heap buffer overflow in Tensorflow
Aliases: CVE-2020-15198
Severity: MODERATE
CWE: CWE-119, CWE-122
Published: 2020-09-25T18:28:22Z

### Impact
The `SparseCountSparseOutput` implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the `indices` tensor has the same shape as the `values` one. The values in these tensors are always accessed in parallel:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/count_ops.cc#L193-L195

Thus, a shape mismatch can result in accesses outside the bounds of heap allocated buffers.

### Patches
We have patched the issue in 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and will release a patch release.

We recommend users to upgrade to TensorFlow 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability is a variant of [GHSA-p5f8-gfw5-33w4](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-p5f8-gfw5-33w4)
Vulnerability: GHSA-jf66-3q76-h5p5
Summary: Tenant and Verifier might not use the same registrar data
Aliases: CVE-2022-1053
Severity: MODERATE
Published: 2022-05-05T15:59:35Z

Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for validating the integrity quote. This allows an attacker to use one AK, EK pair from a real TPM to pass EK validation and give the verifier an AK of a software TPM. A successful attack breaks the entire chain of trust because a not validated AK is used by the verifier. This issue is worse if the validation happens first and then the agent gets added to the verifier because the timing is easier and the verifier does not validate the regcount entry being equal to 1. At this time, there are no known workaround.
Vulnerability: PYSEC-2021-721
Aliases: CVE-2021-29595, GHSA-vf94-36g5-69v8
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. The implementation of the `DepthToSpace` TFLite operator is vulnerable to a division by zero error(https://github.com/tensorflow/tensorflow/blob/0d45ea1ca641b21b73bcf9c00e0179cda284e7e7/tensorflow/lite/kernels/depth_to_space.cc#L63-L69). An attacker can craft a model such that `params->block_size` is 0. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2011-22
Aliases: CVE-2011-4462, GHSA-pcwm-8jc3-qxvj
Published: 2011-12-30T01:55:00Z

Plone 4.1.3 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
Vulnerability: GHSA-98hv-qff3-8793
Summary: Unrestricted Upload of File with Dangerous Type in django-widgy
Aliases: CVE-2020-18704
Severity: CRITICAL
CWE: CWE-434
Published: 2021-08-30T16:24:08Z

Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code via the 'image' widget in the component 'Change Widgy Page'.
Vulnerability: GHSA-cq76-mxrc-vchh
Summary: Crash in `tf.math.segment_*` operations
Aliases: CVE-2021-41195
Severity: MODERATE
CWE: CWE-190
Published: 2021-11-10T19:36:50Z

### Impact
The implementation of `tf.math.segment_*` operations results in a `CHECK`-fail related abort (and denial of service) if a segment id in `segment_ids` is large.

```python
import tensorflow as tf

tf.math.segment_max(data=np.ones((1,10,1)), segment_ids=[1676240524292489355])
tf.math.segment_min(data=np.ones((1,10,1)), segment_ids=[1676240524292489355])
tf.math.segment_mean(data=np.ones((1,10,1)), segment_ids=[1676240524292489355])    
tf.math.segment_sum(data=np.ones((1,10,1)), segment_ids=[1676240524292489355])
tf.math.segment_prod(data=np.ones((1,10,1)), segment_ids=[1676240524292489355])
```

This is similar to [CVE-2021-29584](https://github.com/tensorflow/tensorflow/blob/3a74f0307236fe206b046689c4d76f57c9b74eee/tensorflow/security/advisory/tfsa-2021-071.md) (and similar other reported vulnerabilities in TensorFlow, localized to specific APIs): the [implementation](https://github.com/tensorflow/tensorflow/blob/dae66e518c88de9c11718cd0f8f40a0b666a90a0/tensorflow/core/kernels/segment_reduction_ops_impl.h) (both on CPU and GPU) computes the output shape using [`AddDim`](https://github.com/tensorflow/tensorflow/blob/0b6b491d21d6a4eb5fbab1cca565bc1e94ca9543/tensorflow/core/framework/tensor_shape.cc#L395-L408). However, if the number of elements in the tensor overflows an `int64_t` value, `AddDim` results in a `CHECK` failure which provokes a `std::abort`. Instead, code should use [`AddDimWithStatus`](https://github.com/tensorflow/tensorflow/blob/0b6b491d21d6a4eb5fbab1cca565bc1e94ca9543/tensorflow/core/framework/tensor_shape.cc#L410-L440).


### Patches
We have patched the issue in GitHub commit [e9c81c1e1a9cd8dd31f4e83676cab61b60658429](https://github.com/tensorflow/tensorflow/commit/e9c81c1e1a9cd8dd31f4e83676cab61b60658429) (merging [#51733](https://github.com/tensorflow/tensorflow/pull/51733)).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.      

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.     

### Attribution
This vulnerability has been reported externally via a [GitHub issue](https://github.com/tensorflow/tensorflow/issues/46888).
Vulnerability: PYSEC-2018-80
Aliases: GHSA-fpwp-69xv-c67f, CVE-2018-1000519
Published: 2018-06-26T16:29:00Z

aio-libs aiohttp-session contains a Session Fixation vulnerability in load_session function for RedisStorage (see: https://github.com/aio-libs/aiohttp-session/blob/master/aiohttp_session/redis_storage.py#L42) that can result in Session Hijacking. This attack appear to be exploitable via Any method that allows setting session cookies (?session=<>, or meta tags or script tags with Set-Cookie).
Vulnerability: PYSEC-2021-408
Aliases: CVE-2021-41216, GHSA-3ff2-r28g-w7h9
Published: 2021-11-05T23:15:00Z

TensorFlow is an open source platform for machine learning. In affected versions the shape inference function for `Transpose` is vulnerable to a heap buffer overflow. This occurs whenever `perm` contains negative elements. The shape inference function does not validate that the indices in `perm` are all valid. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Vulnerability: GHSA-5jq3-8437-x35p
Summary: Multiple cross-site scripting (XSS) vulnerabilities in Roundup
Aliases: CVE-2012-6133
Severity: MODERATE
CWE: CWE-79
Published: 2022-04-23T00:40:39Z

Multiple cross-site scripting (XSS) vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML via the (1) @ok_message or (2) @error_message parameter to issue*.
Vulnerability: PYSEC-2022-114
Aliases: CVE-2022-21735, GHSA-87v6-crgm-2gfj
Published: 2022-02-03T13:15:00Z

Tensorflow is an Open Source Machine Learning Framework. The implementation of `FractionalMaxPool` can be made to crash a TensorFlow process via a division by 0. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Vulnerability: GHSA-w4xf-2pqw-5mq7
Summary: Reference binding to nullptr in `RaggedTensorToVariant`
Aliases: CVE-2021-37666
Severity: HIGH
CWE: CWE-824
Published: 2021-08-25T14:42:13Z

### Impact
An attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.RaggedTensorToVariant`:

```python
import tensorflow as tf

tf.raw_ops.RaggedTensorToVariant(
  rt_nested_splits=[],
  rt_dense_values=[1,2,3],
  batched_input=True)
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/ragged_tensor_to_variant_op.cc#L129) has an incomplete validation of the splits values, missing the case when the argument would be empty.

### Patches
We have patched the issue in GitHub commit [be7a4de6adfbd303ce08be4332554dff70362612](https://github.com/tensorflow/tensorflow/commit/be7a4de6adfbd303ce08be4332554dff70362612).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
  
### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-jf7h-7m85-w2v2
Summary: Integer overflow in TFLite memory allocation
Aliases: CVE-2021-29605
Severity: HIGH
CWE: CWE-190
Published: 2021-05-21T14:28:22Z

### Impact
The TFLite code for allocating `TFLiteIntArray`s is [vulnerable to an integer overflow issue](https://github.com/tensorflow/tensorflow/blob/4ceffae632721e52bf3501b736e4fe9d1221cdfa/tensorflow/lite/c/common.c#L24-L27):

```cc
int TfLiteIntArrayGetSizeInBytes(int size) {
  static TfLiteIntArray dummy;
  return sizeof(dummy) + sizeof(dummy.data[0]) * size;
}   
```

An attacker can craft a model such that the `size` multiplier is so large that the return value overflows the `int` datatype and becomes negative. In turn, this results in [invalid value being given to `malloc`](https://github.com/tensorflow/tensorflow/blob/4ceffae632721e52bf3501b736e4fe9d1221cdfa/tensorflow/lite/c/common.c#L47-L52):

```cc
TfLiteIntArray* TfLiteIntArrayCreate(int size) {
  TfLiteIntArray* ret = (TfLiteIntArray*)malloc(TfLiteIntArrayGetSizeInBytes(size));
  ret->size = size; 
  return ret;
}
``` 

In this case, `ret->size` would dereference an invalid pointer.

### Patches
We have patched the issue in GitHub commit [7c8cc4ec69cd348e44ad6a2699057ca88faad3e5](https://github.com/tensorflow/tensorflow/commit/7c8cc4ec69cd348e44ad6a2699057ca88faad3e5).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: PYSEC-2019-209
Aliases: CVE-2019-16778, GHSA-844w-j86r-4x2j
Published: 2019-12-16T21:15:00Z

In TensorFlow before 1.15, a heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32. In this case data_size and num_segments fields are truncated from int64 to int32 and can produce negative numbers, resulting in accessing out of bounds heap memory. This is unlikely to be exploitable and was detected and fixed internally in TensorFlow 1.15 and 2.0.
Vulnerability: GHSA-9gwq-6cwj-47h3
Summary: Integer overflow in TFLite array creation
Aliases: CVE-2022-23558
Severity: HIGH
CWE: CWE-190
Published: 2022-02-09T23:52:24Z

### Impact 
An attacker can craft a TFLite model that would cause an integer overflow [in `TfLiteIntArrayCreate`](https://github.com/tensorflow/tensorflow/blob/ca6f96b62ad84207fbec580404eaa7dd7403a550/tensorflow/lite/c/common.c#L53-L60):

```cc
TfLiteIntArray* TfLiteIntArrayCreate(int size) {
  int alloc_size = TfLiteIntArrayGetSizeInBytes(size);
  // ...
  TfLiteIntArray* ret = (TfLiteIntArray*)malloc(alloc_size);
  // ...
} 
```

The [`TfLiteIntArrayGetSizeInBytes`](https://github.com/tensorflow/tensorflow/blob/ca6f96b62ad84207fbec580404eaa7dd7403a550/tensorflow/lite/c/common.c#L24-L33) returns an `int` instead of a `size_t`:

```cc
int TfLiteIntArrayGetSizeInBytes(int size) {
  static TfLiteIntArray dummy;

  int computed_size = sizeof(dummy) + sizeof(dummy.data[0]) * size;
#if defined(_MSC_VER)
  // Context for why this is needed is in http://b/189926408#comment21
  computed_size -= sizeof(dummy.data[0]);
#endif
  return computed_size;
}
```

An attacker can control model inputs such that `computed_size` overflows the size of `int` datatype.

### Patches
We have patched the issue in GitHub commit [a1e1511dde36b3f8aa27a6ec630838e7ea40e091](https://github.com/tensorflow/tensorflow/commit/a1e1511dde36b3f8aa27a6ec630838e7ea40e091).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.
Vulnerability: GHSA-pq7m-3gw7-gq5x
Summary: Execution with Unnecessary Privileges in ipython
Aliases: CVE-2022-21699
Severity: HIGH
CWE: CWE-279, CWE-250, CWE-269
Published: 2022-01-21T18:55:30Z

We’d like to disclose an arbitrary code execution vulnerability in IPython that stems from IPython executing untrusted files in CWD. This vulnerability allows one user to run code as another.
 
Proof of concept

User1:
```
mkdir -m 777 /tmp/profile_default
mkdir -m 777 /tmp/profile_default/startup
echo 'print("stealing your private secrets")' > /tmp/profile_default/startup/foo.py
```

User2:
```
cd /tmp
ipython
```

 

User2 will see:
```
Python 3.9.7 (default, Oct 25 2021, 01:04:21)
Type 'copyright', 'credits' or 'license' for more information
IPython 7.29.0 -- An enhanced Interactive Python. Type '?' for help.
stealing your private secrets
```


## Patched release and documentation

See https://ipython.readthedocs.io/en/stable/whatsnew/version8.html#ipython-8-0-1-cve-2022-21699, 

Version 8.0.1, 7.31.1 for current Python version are recommended. 
Version 7.16.3 has also been published for Python 3.6 users, 
Version 5.11 (source only, 5.x branch on github) for older Python versions.
Vulnerability: PYSEC-2021-50
Aliases: CVE-2021-25281
Published: 2021-02-27T05:15:00Z

An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.
Vulnerability: GHSA-v3f7-j968-4h5f
Summary: Division by zero in Tensorflow
Aliases: CVE-2022-21725
Severity: MODERATE
CWE: CWE-369
Published: 2022-02-10T00:15:07Z

### Impact 
The [estimator for the cost of some convolution operations](https://github.com/tensorflow/tensorflow/blob/ffa202a17ab7a4a10182b746d230ea66f021fe16/tensorflow/core/grappler/costs/op_level_cost_estimator.cc#L189-L198) can be made to execute a division by 0:

```python
import tensorflow as tf

@tf.function
def test():
  y=tf.raw_ops.AvgPoolGrad(
    orig_input_shape=[1,1,1,1],
    grad=[[[[1.0],[1.0],[1.0]]],[[[2.0],[2.0],[2.0]]],[[[3.0],[3.0],[3.0]]]],
    ksize=[1,1,1,1],
    strides=[1,1,1,0],
    padding='VALID',
    data_format='NCHW')
  return y

test()
```

The function fails to check that the stride argument is stricly positive:

```cc
int64_t GetOutputSize(const int64_t input, const int64_t filter,
                      const int64_t stride, const Padding& padding) {
  // Logic for calculating output shape is from GetWindowedOutputSizeVerbose() 
  // function in third_party/tensorflow/core/framework/common_shape_fns.cc.
  if (padding == Padding::VALID) {
    return (input - filter + stride) / stride;
  } else {  // SAME.
    return (input + stride - 1) / stride;
  }
} 
```

Hence, the fix is to add a check for the stride argument to ensure it is valid.

### Patches
We have patched the issue in GitHub commit [3218043d6d3a019756607643cf65574fbfef5d7a](https://github.com/tensorflow/tensorflow/commit/3218043d6d3a019756607643cf65574fbfef5d7a).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.
Vulnerability: GHSA-wgmx-52ph-qqcw
Summary: High severity vulnerability that affects qutebrowser
Aliases: CVE-2018-10895
Severity: HIGH
CWE: CWE-352
Published: 2018-10-10T16:05:23Z

qutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery flaw that allows websites to access 'qute://*' URLs. A malicious website could exploit this to load a 'qute://settings/set' URL, which then sets 'editor.command' to a bash script, resulting in arbitrary code execution.
Vulnerability: PYSEC-2014-9
Aliases: CVE-2014-3146
Published: 2014-05-14T19:55:00Z

Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.
Vulnerability: GHSA-87cj-px37-rc3x
Summary: OS Command Injection in bikeshed
Aliases: CVE-2021-23422
Severity: HIGH
CWE: CWE-78
Published: 2021-08-30T16:25:35Z

This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing Inline Tag Command metadata is processed. When an arbitrary OS command is executed, the command output would be included in the HTML output.
Vulnerability: PYSEC-2014-37
Aliases: CVE-2012-5495
Published: 2014-09-30T14:55:00Z

python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to "go_back."
Vulnerability: PYSEC-2021-536
Aliases: GHSA-rgvq-pcvf-hx75, CVE-2021-29608
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. Due to lack of validation in `tf.raw_ops.RaggedTensorToTensor`, an attacker can exploit an undefined behavior if input arguments are empty. The implementation(https://github.com/tensorflow/tensorflow/blob/656e7673b14acd7835dc778867f84916c6d1cac2/tensorflow/core/kernels/ragged_tensor_to_tensor_op.cc#L356-L360) only checks that one of the tensors is not empty, but does not check for the other ones. There are multiple `DCHECK` validations to prevent heap OOB, but these are no-op in release builds, hence they don't prevent anything. The fix will be included in TensorFlow 2.5.0. We will also cherrypick these commits on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.