search

davidspek / kubeflownotebooks

Notebook Server Images for Kubeflow
9 stars 6 forks source link

CVE-2023-25665 (High) detected in tensorflow_gpu-2.8.0-cp37-cp37m-manylinux2010_x86_64.whl, tensorflow-2.8.0-cp37-cp37m-manylinux2010_x86_64.whl #761

Open mend-bolt-for-github[bot] opened 1 year ago

mend-bolt-for-github[bot] commented 1 year ago

CVE-2023-25665 - High Severity Vulnerability

Vulnerable Libraries - tensorflow_gpu-2.8.0-cp37-cp37m-manylinux2010_x86_64.whl, tensorflow-2.8.0-cp37-cp37m-manylinux2010_x86_64.whl

tensorflow_gpu-2.8.0-cp37-cp37m-manylinux2010_x86_64.whl

Removed: please install "tensorflow" instead.

Library home page: https://files.pythonhosted.org/packages/d8/d4/9fe4a157732125206185970c6e673483468bda299378be52bc4b8e765943/tensorflow_gpu-2.8.0-cp37-cp37m-manylinux2010_x86_64.whl

Path to dependency file: /jupyter-tensorflow/cuda-requirements.txt

Path to vulnerable library: /jupyter-tensorflow/cuda-requirements.txt

Dependency Hierarchy: - :x: **tensorflow_gpu-2.8.0-cp37-cp37m-manylinux2010_x86_64.whl** (Vulnerable Library)

tensorflow-2.8.0-cp37-cp37m-manylinux2010_x86_64.whl

TensorFlow is an open source machine learning framework for everyone.

Library home page: https://files.pythonhosted.org/packages/31/66/d9cd0b850397dbd33f070cc371a183b4903120b1c103419e9bf20568456e/tensorflow-2.8.0-cp37-cp37m-manylinux2010_x86_64.whl

Path to dependency file: /jupyter-tensorflow/cpu-requirements.txt

Path to vulnerable library: /jupyter-tensorflow/cpu-requirements.txt

Dependency Hierarchy: - :x: **tensorflow-2.8.0-cp37-cp37m-manylinux2010_x86_64.whl** (Vulnerable Library)

Found in base branch: master

Vulnerability Details

TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when `SparseSparseMaximum` is given invalid sparse tensors as inputs, it can give a null pointer error. A fix is included in TensorFlow version 2.12 and version 2.11.1.

Publish Date: 2023-03-25

URL: CVE-2023-25665

CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-25665

Release Date: 2023-03-25

Fix Resolution: tensorflow - 2.11.1,2.12.0, tensorflow-cpu - 2.11.1,2.12.0, tensorflow-gpu - 2.11.1,2.12.0

Step up your Open Source Security Game with Mend here