CVE-2021-29613CWE-665

Incomplete validation in `tf.raw_ops.CTCLoss`

Medium · published May 14, 2021

CVSS v3.1
6.3
EPSS
0%
Percentile
14.3
In the wild
Unconfirmed
What it is

TensorFlow is an end-to-end open source platform for machine learning. Incomplete validation in `tf.raw_ops.CTCLoss` allows an attacker to trigger an OOB read from heap. The fix will be included in TensorFlow 2.5.0. We will also cherrypick these commits on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00240 · 14.3th percentile
Weakness
CWE-665 · Improper Initialization
Published
2021-05-14T19:20Z
EPSS history
Timeline
  • 14 MAY 19:20Z
    Incomplete validation in `tf.raw_ops.CTCLoss`
    cvelistv5