Open mend-bolt-for-github[bot] opened 1 year ago
TensorFlow is an open source machine learning framework for everyone.
Library home page: https://files.pythonhosted.org/packages/31/66/d9cd0b850397dbd33f070cc371a183b4903120b1c103419e9bf20568456e/tensorflow-2.8.0-cp37-cp37m-manylinux2010_x86_64.whl
Path to dependency file: /jupyter-tensorflow/cpu-requirements.txt
Path to vulnerable library: /jupyter-tensorflow/cpu-requirements.txt
Dependency Hierarchy: - :x: **tensorflow-2.8.0-cp37-cp37m-manylinux2010_x86_64.whl** (Vulnerable Library)
Found in base branch: master
TensorFlow is an open source platform for machine learning. Versions prior to 2.12.0 and 2.11.1 are vulnerable to integer overflow in EditDistance. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.
Publish Date: 2023-03-25
URL: CVE-2023-25662
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
Type: Upgrade version
Origin: https://github.com/tensorflow/tensorflow/security/advisories/GHSA-7jvm-xxmr-v5cw
Release Date: 2023-03-24
Fix Resolution: tensorflow - 2.11.1,2.12.0, tensorflow-cpu - 2.11.1,2.12.0, tensorflow-gpu - 2.11.1,2.12.0
Step up your Open Source Security Game with Mend here
CVE-2023-25662 - High Severity Vulnerability
TensorFlow is an open source machine learning framework for everyone.
Library home page: https://files.pythonhosted.org/packages/31/66/d9cd0b850397dbd33f070cc371a183b4903120b1c103419e9bf20568456e/tensorflow-2.8.0-cp37-cp37m-manylinux2010_x86_64.whl
Path to dependency file: /jupyter-tensorflow/cpu-requirements.txt
Path to vulnerable library: /jupyter-tensorflow/cpu-requirements.txt
Dependency Hierarchy: - :x: **tensorflow-2.8.0-cp37-cp37m-manylinux2010_x86_64.whl** (Vulnerable Library)
Found in base branch: master
TensorFlow is an open source platform for machine learning. Versions prior to 2.12.0 and 2.11.1 are vulnerable to integer overflow in EditDistance. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.
Publish Date: 2023-03-25
URL: CVE-2023-25662
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/tensorflow/tensorflow/security/advisories/GHSA-7jvm-xxmr-v5cw
Release Date: 2023-03-24
Fix Resolution: tensorflow - 2.11.1,2.12.0, tensorflow-cpu - 2.11.1,2.12.0, tensorflow-gpu - 2.11.1,2.12.0
Step up your Open Source Security Game with Mend here