aswin1906/github-advisory-2019.csv huggingface dataset:
HTTP Request Smuggling: LF vs CRLF handling in Waitress
Advisory: GHSA-pg36-wpm5-g57p
Aliases: CVE-2019-16785
Published: 2019-12-20T23:03:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Affected: package: ecosystem: PyPI
name: waitress
ecosystem_specific: affected_functions: waitress.parser.HTTPRequestParser.parse_header
waitress.parser.get_header_lines
waitress.receiver.ChunkedReceiver
waitress.receiver.ChunkedReceiver.received
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.4.0
cwe_ids: CWE-444
severity: HIGH

### Impact

Waitress implemented a &amp;quot;MAY&amp;quot; part of the RFC7230 (https://tools.ietf.org/html/rfc7230#section-3.5) which states:

      Although the line terminator for the start-line and header fields is
      the sequence CRLF, a recipient MAY recognize a single LF as a line
      terminator and ignore any preceding CR.

Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways. This can lead to a potential for HTTP request smuggling/splitting whereby Waitress may see two requests while the front-end server only sees a single HTTP message.

Example:

```
Content-Length: 100[CRLF]
X-Header: x[LF]Content-Length: 0[CRLF]
```

Would get treated by Waitress as if it were:

```
Content-Length: 100
X-Header: x
Content-Length: 0
```

This could potentially get used by attackers to split the HTTP request and smuggle a second request in the body of the first.


### Patches

This issue is fixed in Waitress 1.4.0. This brings a range of changes to harden Waitress against potential HTTP request confusions, and may change the behaviour of Waitress behind non-conformist proxies. 

Waitress no longer implements the MAY part of the specification and instead requires that all lines are terminated correctly with CRLF. If any lines are found with a bare CR or LF a 400 Bad Request is sent back to the requesting entity.

The Pylons Project recommends upgrading as soon as possible, while validating that the changes in Waitress don&amp;#39;t cause any changes in behavior.

### Workarounds

Various reverse proxies may have protections against sending potentially bad HTTP requests to the backend, and or hardening against potential issues like this. If the reverse proxy doesn&amp;#39;t use HTTP/1.1 for connecting to the backend issues are also somewhat mitigated, as HTTP pipelining does not exist in HTTP/1.0 and Waitress will close the connection after every single request (unless the Keep Alive header is explicitly sent... so this is not a fool proof security method)

### Issues/more security issues:

* open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related)
* email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)
Argument injection in a MimeTypeGuesser in Symfony
Advisory: GHSA-xhh6-956q-4q69
Aliases: CVE-2019-18888
Published: 2019-12-02T18:08:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: Packagist
name: symfony/http-foundation
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 2.8.52
package: ecosystem: Packagist
name: symfony/http-foundation
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.4.35
package: ecosystem: Packagist
name: symfony/http-foundation
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.2.12
package: ecosystem: Packagist
name: symfony/http-foundation
ranges: type: ECOSYSTEM
events: introduced: 4.3.0
fixed: 4.3.8
package: ecosystem: Packagist
name: symfony/mime
ranges: type: ECOSYSTEM
events: introduced: 4.3.0
fixed: 4.3.8
package: ecosystem: Packagist
name: symfony/symfony
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 2.8.52
package: ecosystem: Packagist
name: symfony/symfony
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.4.35
package: ecosystem: Packagist
name: symfony/symfony
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.2.12
package: ecosystem: Packagist
name: symfony/symfony
ranges: type: ECOSYSTEM
events: introduced: 4.3.0
fixed: 4.3.8
cwe_ids: CWE-20
CWE-88
severity: HIGH

An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. This is related to symfony/http-foundation (and symfony/mime in 4.3.x).
Internal exception message exposure for login action in Sylius
Advisory: GHSA-3r8j-pmch-5j2h
Aliases: CVE-2019-16768
Published: 2019-12-05T19:57:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Affected: package: ecosystem: Packagist
name: sylius/sylius
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.3.14
package: ecosystem: Packagist
name: sylius/sylius
ranges: type: ECOSYSTEM
events: introduced: 1.4.0
fixed: 1.4.10
package: ecosystem: Packagist
name: sylius/sylius
ranges: type: ECOSYSTEM
events: introduced: 1.5.0
fixed: 1.5.7
package: ecosystem: Packagist
name: sylius/sylius
ranges: type: ECOSYSTEM
events: introduced: 1.6.0
fixed: 1.6.3
cwe_ids: CWE-209
severity: LOW

## Internal exception message exposure for login action

### Impact
Exception messages from internal exceptions (like database exception) are wrapped by `\Symfony\Component\Security\Core\Exception\AuthenticationServiceException` and propagated through the system to UI. Therefore, some internal system information may leak and be visible to the customer. 

A validation message with the exception details will be presented to the user when one will try to log into the shop. 

### Patches
_Has the problem been patched? What versions should users upgrade to?_

### Workarounds
The `src/Sylius/Bundle/UiBundle/Resources/views/Security/_login.html.twig` file should be overridden and lines https://github.com/Sylius/Sylius/blob/1.4/src/Sylius/Bundle/UiBundle/Resources/views/Security/_login.html.twig#L13-L17 should be replaced with
```twig
        {% if last_error %}
            <div class="ui left aligned basic segment">
                {{ messages.error(last_error.messageKey) }}
            </div>
        {% endif %}
``` 

The `messageKey` field should be used instead of the `message`.
Prototype Pollution in chartkick
Advisory: GHSA-5pm8-492c-92p5
Aliases: CVE-2019-18841
Published: 2019-12-02T18:04:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected: package: ecosystem: RubyGems
name: chartkick
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.3.0
package: ecosystem: npm
name: chartkick
ranges: type: ECOSYSTEM
events: introduced: 3.1.0
fixed: 3.2.0
database_specific: last_known_affected_version_range: <= 3.1.3
severity: HIGH

Affected versions of `@polymer/polymer` are vulnerable to prototype pollution. The package fails to prevent modification of object prototypes through chart options containing a payload such as `{"__proto__": {"polluted": true}}`. It is possible to achieve the same results if a chart loads data from a malicious server.


## Recommendation

Upgrade to version 3.2.0 or later.
Python Twisted trustRoot is not respected in HTTP client
Advisory: GHSA-3c45-wgjp-7v9r
Aliases: CVE-2014-7143
Published: 2019-12-17T22:52:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: PyPI
name: twisted
ranges: type: ECOSYSTEM
events: introduced: 14.0.0
fixed: 14.0.1
versions: 14.0.0
cwe_ids: CWE-295
severity: HIGH

Python Twisted 14.0.0 `trustRoot` is not respected in HTTP client
Django allows unintended model editing
Advisory: GHSA-hvmf-r92r-27hr
Aliases: CVE-2019-19118
Published: 2019-12-04T21:26:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 2.1.0
fixed: 2.1.15
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 2.2.0
fixed: 2.2.8
cwe_ids: CWE-276
severity: MODERATE

Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model's save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.)
Sandbox Breakout / Arbitrary Code Execution in safer-eval
Advisory: GHSA-v63x-xc9j-hhvq
Aliases: CVE-2019-10769
Published: 2019-12-11T02:01:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: safer-eval
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.3.6
cwe_ids: CWE-20
CWE-94
severity: CRITICAL

All versions of `safer-eval` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context and is not suited to process arbitrary user input. This may allow attackers to execute arbitrary code in the system.


## Recommendation

The package is not meant to receive user input. Consider using an alternative package until a fix is made available.
Invalid HTTP method overrides allow possible XSS or other attacks in Symfony
Advisory: GHSA-x92h-wmg2-6hp7
Aliases: CVE-2019-10913
Published: 2019-12-02T18:10:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Packagist
name: symfony/http-foundation
ranges: type: ECOSYSTEM
events: introduced: 2.7.0
fixed: 2.7.51
package: ecosystem: Packagist
name: symfony/http-foundation
ranges: type: ECOSYSTEM
events: introduced: 2.8.0
fixed: 2.8.50
package: ecosystem: Packagist
name: symfony/http-foundation
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.4.26
package: ecosystem: Packagist
name: symfony/http-foundation
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.1.12
package: ecosystem: Packagist
name: symfony/http-foundation
ranges: type: ECOSYSTEM
events: introduced: 4.2.0
fixed: 4.2.7
package: ecosystem: Packagist
name: symfony/symfony
ranges: type: ECOSYSTEM
events: introduced: 2.7.0
fixed: 2.7.51
package: ecosystem: Packagist
name: symfony/symfony
ranges: type: ECOSYSTEM
events: introduced: 2.8.0
fixed: 2.8.50
package: ecosystem: Packagist
name: symfony/symfony
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.4.26
package: ecosystem: Packagist
name: symfony/symfony
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.1.12
package: ecosystem: Packagist
name: symfony/symfony
ranges: type: ECOSYSTEM
events: introduced: 4.2.0
fixed: 4.2.7
cwe_ids: CWE-79
CWE-89
severity: CRITICAL

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.
possible DoS caused by malformed signature decoding in Pure-Python ECDSA
Advisory: GHSA-2mrj-435v-c2cr
Published: 2019-12-02T18:15:31Z
Withdrawn: 2020-06-16T20:15:24Z
Affected: package: ecosystem: PyPI
name: ecdsa
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.13.3
severity: MODERATE

**Withdrawn:** Duplicate of GHSA-pwfw-mgfj-7g3g.
npm Vulnerable to Global node_modules Binary Overwrite
Advisory: GHSA-4328-8hgf-7wjr
Aliases: CVE-2019-16777
Published: 2019-12-13T15:39:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected: package: ecosystem: npm
name: npm
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 6.13.4
cwe_ids: CWE-22
CWE-269
severity: HIGH

Versions of  the npm CLI prior to 6.13.4 are vulnerable to a Global node_modules Binary Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. 

For example, if a package was installed globally and created a `serve` binary, any subsequent installs of packages that also create a `serve` binary would overwrite the first binary. This will not overwrite system binaries but only binaries put into the global node_modules directory.

This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.


## Recommendation

Upgrade to version 6.13.4 or later.
Information disclosure in the Contao backend
Advisory: GHSA-4mvc-qc5w-v5qr
Aliases: CVE-2019-19712
Published: 2019-12-17T22:53:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: package: ecosystem: Packagist
name: contao/core-bundle
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.4.46
package: ecosystem: Packagist
name: contao/core-bundle
ranges: type: ECOSYSTEM
events: introduced: 4.5.0
fixed: 4.8.6
cwe_ids: CWE-276
severity: MODERATE

### Impact

Backend users can manipulate the details view URL to show pages and articles that have not been enabled for them.

### Patches

Update to Contao 4.4.46 or 4.8.6.

### Workarounds

None.

### References

https://contao.org/en/security-advisories/information-disclosure-in-the-back-end

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
In RubyGem excon, interrupted Persistent Connections May Leak Response Data
Advisory: GHSA-q58g-455p-8vw9
Aliases: CVE-2019-16779
Published: 2019-12-16T19:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
Affected: package: ecosystem: RubyGems
name: excon
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.71.0
cwe_ids: CWE-362
CWE-664
severity: MODERATE

### Impact
There was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.

### Patches
The problem has been patched in 0.71.0, users should upgrade to this or a newer version (if one exists).

### Workarounds
Users can workaround the problem by disabling persistent connections, though this may cause performance implications.

### References
See the [patch](https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29) for further details.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [excon/issues](https://github.com/excon/excon/issues)
* Email us at [geemus+github@gmail.com](mailto:geemus+github@gmail.com)
Arbitrary File Write in npm
Advisory: GHSA-m6cx-g6qm-p2cx
Aliases: CVE-2019-16775
Published: 2019-12-13T15:39:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected: package: ecosystem: npm
name: npm
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 6.13.3
cwe_ids: CWE-59
CWE-61
severity: HIGH

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to create files on a user's system when the package is installed. It is only possible to affect files that the user running `npm install` has access to and it is not possible to over write files that already exist on disk.

This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.


## Recommendation

Upgrade to version 6.13.3 or later.
Validation bypass is possible in Json Pattern Validator
Advisory: GHSA-rh46-3fgc-mvrf
Aliases: CVE-2019-19507
Published: 2019-12-04T21:25:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: package: ecosystem: npm
name: jpv
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.1.1
cwe_ids: CWE-287
severity: MODERATE

In jpv (aka Json Pattern Validator) before 2.1.1, compareCommon() can be bypassed because certain internal attributes can be overwritten via a conflicting name, as demonstrated by 'constructor': {'name':'Array'}. This affects validate(). Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
Unsafe deserialization in SmtpTransport in CakePHP
Advisory: GHSA-qhrx-hcm6-pmrw
Aliases: CVE-2019-11458
Published: 2019-12-02T18:12:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: Packagist
name: cakephp/cakephp
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.5.18
package: ecosystem: Packagist
name: cakephp/cakephp
ranges: type: ECOSYSTEM
events: introduced: 3.6.0
fixed: 3.6.15
package: ecosystem: Packagist
name: cakephp/cakephp
ranges: type: ECOSYSTEM
events: introduced: 3.7.0
fixed: 3.7.7
cwe_ids: CWE-502
severity: HIGH

An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction.
Object injection in cookie driver in phpfastcache
Advisory: GHSA-484f-743f-6jx2
Aliases: CVE-2019-16774
Published: 2019-12-12T22:50:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Packagist
name: phpfastcache/phpfastcache
ranges: type: ECOSYSTEM
events: introduced: 5.0.0
fixed: 5.0.13
cwe_ids: CWE-94
severity: MODERATE

### Impact
An possible object injection has been discovered in cookie driver prior 5.0.13 versions (of 5.x releases).

### Patches
The issue has been addressed by enforcing JSON conversion when deserializing

### Workarounds
If you can't fix it, use another driver such as "Files" (Filesystem)

### References
Fixing release: https://github.com/PHPSocialNetwork/phpfastcache/releases/tag/5.0.13

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the issue tracker](https://github.com/PHPSocialNetwork/phpfastcache/issues)
* Email us at [security@geolim4.com](mailto:security@geolim4.com)
Strapi allows unauthenticated attacker to reset admin password without valid reset token
Advisory: GHSA-6xc2-mj39-q599
Aliases: CVE-2019-18818
Published: 2019-12-02T18:20:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: strapi
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.0.0-beta.17.5
database_specific: last_known_affected_version_range: <= 3.0.0-beta.17.4
cwe_ids: CWE-640
severity: CRITICAL

Versions of `strapi` prior to 3.0.0-beta.17.5 are vulnerable to Privilege Escalation. The password reset routes allows an unauthenticated attacker to reset an admin's password without providing a valid password reset token.


## Recommendation

Upgrade to version 3.0.0-beta.17.5 or later.
npm symlink reference outside of node_modules
Advisory: GHSA-x8qc-rrcw-4r46
Aliases: CVE-2019-16776
Published: 2019-12-13T15:39:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected: package: ecosystem: npm
name: npm
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 6.13.3
cwe_ids: CWE-22
severity: HIGH

Versions of the npm CLI prior to 6.13.3 are vulnerable to a symlink reference outside of node_modules. It is possible for packages to create symlinks to files outside of the`node_modules` folder through the `bin` field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user’s system when the package is installed. Only files accessible by the user running the `npm install` are affected.  

This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.


## Recommendation

Upgrade to version 6.13.3 or later.
Symfony Unsafe Cache Serialization Could Enable RCE
Advisory: GHSA-79gr-58r3-pwm3
Aliases: CVE-2019-18889
Published: 2019-12-02T18:07:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Packagist
name: symfony/cache
ranges: type: ECOSYSTEM
events: introduced: 3.1.0
fixed: 3.4.35
package: ecosystem: Packagist
name: symfony/cache
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.2.12
package: ecosystem: Packagist
name: symfony/cache
ranges: type: ECOSYSTEM
events: introduced: 4.3.0
fixed: 4.3.8
package: ecosystem: Packagist
name: symfony/symfony
ranges: type: ECOSYSTEM
events: introduced: 3.1.0
fixed: 3.4.35
package: ecosystem: Packagist
name: symfony/symfony
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.2.12
package: ecosystem: Packagist
name: symfony/symfony
ranges: type: ECOSYSTEM
events: introduced: 4.3.0
fixed: 4.3.8
cwe_ids: CWE-94
severity: CRITICAL

An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could result in remote code injection. This is related to symfony/cache.
Heap buffer overflow in `UnsortedSegmentSum` in TensorFlow
Advisory: GHSA-844w-j86r-4x2j
Aliases: CVE-2019-16778
Published: 2019-12-16T20:17:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
Affected: package: ecosystem: PyPI
name: tensorflow
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.15
package: ecosystem: PyPI
name: tensorflow-cpu
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.15
package: ecosystem: PyPI
name: tensorflow-gpu
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.15
cwe_ids: CWE-122
CWE-681
severity: LOW

### Impact

A heap buffer overflow in `UnsortedSegmentSum` can be produced when the `Index` template argument is `int32`. In this case `data_size` and `num_segments` fields are truncated from `int64` to `int32` and can produce negative numbers, resulting in accessing out of bounds heap memory.

This is unlikely to be exploitable and was detected and fixed internally. We are making the security advisory only to notify users that it is better to update to TensorFlow 1.15 or 2.0 or later as these versions already have this fixed.

### Patches

Patched by db4f9717c41bccc3ce10099ab61996b246099892 and released in all official releases after 1.15 and 2.0.

### For more information
Please consult [`SECURITY.md`](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.