Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2020-15206
Good to know:
Date: September 25, 2020
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, changing the TensorFlow's "SavedModel" protocol buffer and altering the name of required keys results in segfaults and data corruption while loading the model. This can cause a denial of service in products using "tensorflow-serving" or other inference-as-a-service installments. Fixed were added in commits f760f88b4267d981e13f4b302c437ae800445968 and fcfef195637c6e365577829c4d67681695956e7d (both going into TensorFlow 2.2.0 and 2.3.0 but not yet backported to earlier versions). However, this was not enough, as #41097 reports a different failure mode. The issue is patched in commit adf095206f25471e864a8e63a0f1caef53a0e3a6, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
Language: C++
Severity Score
Related Resources (12)
Severity Score
Weakness Type (CWE)
Improper Input Validation
CWE-20Top Fix
Upgrade Version
Upgrade to version tensorflow - 1.15.4;tensorflow - 2.0.3;tensorflow - 2.1.2;tensorflow - 2.2.1;tensorflow - 2.3.1;tensorflow-cpu - 2.1.2;tensorflow-cpu - 2.2.1;tensorflow-cpu - 2.3.1;tensorflow-gpu - 1.15.4;tensorflow-gpu - 2.0.3;tensorflow-gpu - 2.1.2;tensorflow-gpu - 2.2.1;tensorflow-gpu - 2.3.1
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | HIGH |
| Privileges Required (PR): | NONE |
| User Interaction (UI): | NONE |
| Scope (S): | CHANGED |
| Confidentiality (C): | HIGH |
| Integrity (I): | HIGH |
| Availability (A): | HIGH |
CVSS v2
| Base Score: |
|
|---|---|
| Access Vector (AV): | NETWORK |
| Access Complexity (AC): | LOW |
| Authentication (AU): | NONE |
| Confidentiality (C): | NONE |
| Integrity (I): | NONE |
| Availability (A): | PARTIAL |
| Additional information: |