CVE-2021-41207 — MEDIUM (CVSS 5.5) AI Security Vulnerability

TensorFlow is an open source platform for machine learning. In affected versions the implementation of `ParallelConcat` misses some input validation and can produce a division by 0. The fix will be...

Full analysis pending. Showing NVD description excerpt.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
tensorflow	pip	—	No patch
tensorflow	pip	—	No patch
tensorflow	pip	—	No patch
tensorflow	pip	—	No patch
tensorflow	pip	—	No patch
tensorflow	pip	>= 2.6.0, < 2.6.1	`2.6.1`
tensorflow-cpu	pip	>= 0, < 2.4.4	`2.4.4`
tensorflow-gpu	pip	>= 0, < 2.4.4	`2.4.4`

Severity & Risk

CVSS 3.1

5.5 / 10

EPSS

0.0%

chance of exploitation in 30 days

KEV Status

Not in KEV

Sophistication

N/A

Recommended Action

Patch available

Update tensorflow to version 2.6.1

Update tensorflow-cpu to version 2.4.4

Update tensorflow-gpu to version 2.4.4

Compliance Impact

Compliance analysis pending. Sign in for full compliance mapping when available.

Technical Details

NVD Description

TensorFlow is an open source platform for machine learning. In affected versions the implementation of `ParallelConcat` misses some input validation and can produce a division by 0. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

Weaknesses (CWE)

CWE-369 Divide By Zero Primary CWE-369

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Timeline

Published

November 5, 2021

Last Modified

November 21, 2024

First Seen

November 5, 2021