PT-2026-59982 · Pypi · Tensorflow-Cpu
Publicado
2026-07-13
·
Atualizado
2026-07-13
CVSS v3.1
4.8
Média
| Vetor | AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H |
Impact
An input
encoded that is not a valid CompositeTensorVariant tensor will trigger a segfault in [tf.raw ops.CompositeTensorVariantToComponents](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/python/lib/core/py func.cc).python
import tensorflow as tf
encode = tf.raw ops.EmptyTensorList(element dtype=tf.int32, element shape=[10, 15], max num elements=2)
meta= ""
component=[tf.int32]
print(tf.raw ops.CompositeTensorVariantToComponents(encoded=encode,metadata=meta,Tcomponents=component))Patches
We have patched the issue in GitHub commits bf594d08d377dc6a3354d9fdb494b32d45f91971 and 660ce5a89eb6766834bdc303d2ab3902aef99d3d.
The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by pattarakritr@smu.edu.sg
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Tensorflow-Cpu