id: PYSEC-2020-298
details: In affected versions of TensorFlow the tf.raw_ops.DataFormatVecPermute API
  does not validate the src_format and dst_format attributes. The code assumes that
  these two arguments define a permutation of NHWC. This can result in uninitialized
  memory accesses, read outside of bounds and even crashes. This is fixed in versions
  1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.
affected:
- package:
    name: tensorflow-cpu
    ecosystem: PyPI
    purl: pkg:pypi/tensorflow-cpu
  ranges:
  - type: GIT
    repo: https://github.com/tensorflow/tensorflow
    events:
    - introduced: "0"
    - fixed: ebc70b7a592420d3d2f359e4b1694c236b82c7ae
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.15.5
    - introduced: 2.0.0
    - fixed: 2.0.4
    - introduced: 2.1.0
    - fixed: 2.1.3
    - introduced: 2.2.0
    - fixed: 2.2.2
    - introduced: 2.3.0
    - fixed: 2.3.2
  versions:
  - 1.15.0
  - 2.1.0
  - 2.1.1
  - 2.1.2
  - 2.2.0
  - 2.2.1
  - 2.3.0
  - 2.3.1
references:
- type: FIX
  url: https://github.com/tensorflow/tensorflow/commit/ebc70b7a592420d3d2f359e4b1694c236b82c7ae
- type: ADVISORY
  url: https://github.com/tensorflow/tensorflow/security/advisories/GHSA-c9f3-9wfr-wgh7
aliases:
- CVE-2020-26267
- GHSA-c9f3-9wfr-wgh7
modified: "2021-12-09T06:34:44.408160Z"
published: "2020-12-10T23:15:00Z"