search

Killy85 / game_ai_trainer

This repository is home of a Machine Learning project aiming at training an agent to play a game using Reinforcement learning
Apache License 2.0
0 stars 0 forks source link

CVE-2023-25674 (High) detected in tensorflow-1.13.1-cp27-cp27mu-manylinux1_x86_64.whl #432

Open mend-bolt-for-github[bot] opened 1 year ago

mend-bolt-for-github[bot] commented 1 year ago

CVE-2023-25674 - High Severity Vulnerability

Vulnerable Library - tensorflow-1.13.1-cp27-cp27mu-manylinux1_x86_64.whl

TensorFlow is an open source machine learning framework for everyone.

Library home page: https://files.pythonhosted.org/packages/d2/ea/ab2c8c0e81bd051cc1180b104c75a865ab0fc66c89be992c4b20bbf6d624/tensorflow-1.13.1-cp27-cp27mu-manylinux1_x86_64.whl

Path to dependency file: /game_ai_trainer/requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy: - :x: **tensorflow-1.13.1-cp27-cp27mu-manylinux1_x86_64.whl** (Vulnerable Library)

Found in base branch: master

Vulnerability Details

TensorFlow is an open source machine learning platform. Versions prior to 2.12.0 and 2.11.1 have a null pointer error in RandomShuffle with XLA enabled. A fix is included in TensorFlow 2.12.0 and 2.11.1.

Publish Date: 2023-03-25

URL: CVE-2023-25674

CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gf97-q72m-7579

Release Date: 2023-03-24

Fix Resolution: tensorflow - 2.11.1,2.12.0, tensorflow-cpu - 2.11.1,2.12.0, tensorflow-gpu - 2.11.1,2.12.0

Step up your Open Source Security Game with Mend here