Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2022-41896

Good to know:

icon

Date: November 17, 2022

TensorFlow is an open source platform for machine learning. If `ThreadUnsafeUnigramCandidateSampler` is given input `filterbank_channel_count` greater than the allowed max size, TensorFlow will crash. We have patched the issue in GitHub commit 39ec7eaf1428e90c37787e5b3fbd68ebd3c48860. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

Language: Python

Severity Score

Related Resources (6)

https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/image/mirror_pad_op.cc
https://github.com/tensorflow/tensorflow/commit/39ec7eaf1428e90c37787e5b3fbd68ebd3c48860
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rmg2-f698-wq35
https://nvd.nist.gov/vuln/detail/CVE-2022-41896
https://github.com/tensorflow/tensorflow
https://www.mend.io/vulnerability-database/CVE-2022-41896

Severity Score

Weakness Type (CWE)

Input Validation

CWE-20

Improper Validation of Specified Quantity in Input

CWE-1284

Top Fix

icon

Upgrade Version

Upgrade to version https://github.com/advisories/GHSA-rmg2-f698-wq35

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): LOW
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): HIGH

Do you need more information?

Contact Us