OSV-2021-449

UNKNOWN READ in std::pair<absl::lts_NUMBER_02_25::container_internal::raw_hash_set<absl::lts_NUM

Not rated yet PyPI

Severity: Not rated yet; No source has published a CVSS score yet
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: None yet; No fixed version published

Description

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31393

Crash type: UNKNOWN READ
Crash state:
std::pair<absl::lts_NUMBER_02_25::container_internal::raw_hash_set<absl::lts_NUM
tensorflow::SparseCount<long, long>::Compute
tensorflow::KernelAndDeviceOp::Run

Affected versions

PyPI

Package	Vulnerable	Fixed in
tensorflow	See the source repository's commits	No fix yet

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

References

Issue reports

bugs.chromium.org/p/oss-fuzz/issues/detail

Timeline

Feb 27, 2021 Published
Apr 13, 2022 Last updated by the source

Advisory	Severity	Why it's related
GHSA-gjh7-xx4r-x345 TensorFlow has segfault in array_ops.upper_bound	High	Also affects tensorflow
GHSA-fxgc-95xx-grvq TensorFlow Denial of Service vulnerability	Medium	Also affects tensorflow
GHSA-93vr-9q9m-pj8p TensorFlow vulnerable to Out-of-Bounds Read in DynamicStitch	High	Also affects tensorflow
GHSA-qjqc-vqcf-5qvj TensorFlow vulnerable to seg fault in `tf.raw_ops.Print`	High	Also affects tensorflow
GHSA-7jvm-xxmr-v5cw TensorFlow vulnerable to integer overflow in EditDistance	High	Also affects tensorflow
GHSA-64jg-wjww-7c5w TensorFlow has Null Pointer Error in TensorArrayConcatV2	High	Also affects tensorflow
GHSA-6hg6-5c2q-7rcr TensorFlow has Heap-buffer-overflow in AvgPoolGrad	High	Also affects tensorflow
GHSA-558h-mq8x-7q9g TensorFlow has Null Pointer Error in SparseSparseMaximum	High	Also affects tensorflow

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor