id: PYSEC-2021-501
details: TensorFlow is an end-to-end open source platform for machine learning. The
  implementation of `tf.raw_ops.MaxPoolGradWithArgmax` is vulnerable to a division
  by 0. The implementation(https://github.com/tensorflow/tensorflow/blob/279bab6efa22752a2827621b7edb56a730233bd8/tensorflow/core/kernels/maxpooling_op.cc#L1033-L1034)
  fails to validate that the batch dimension of the tensor is non-zero, before dividing
  by this quantity. The fix will be included in TensorFlow 2.5.0. We will also cherrypick
  this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow
  2.1.4, as these are also affected and still in supported range.
affected:
- package:
    name: tensorflow-cpu
    ecosystem: PyPI
    purl: pkg:pypi/tensorflow-cpu
  ranges:
  - type: GIT
    repo: https://github.com/tensorflow/tensorflow
    events:
    - introduced: "0"
    - fixed: 376c352a37ce5a68b721406dc7e77ac4b6cf483d
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.1.4
    - introduced: 2.2.0
    - fixed: 2.2.3
    - introduced: 2.3.0
    - fixed: 2.3.3
    - introduced: 2.4.0
    - fixed: 2.4.2
  versions:
  - 1.15.0
  - 2.1.0
  - 2.1.1
  - 2.1.2
  - 2.1.3
  - 2.2.0
  - 2.2.1
  - 2.2.2
  - 2.3.0
  - 2.3.1
  - 2.3.2
  - 2.4.0
  - 2.4.1
references:
- type: ADVISORY
  url: https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9vpm-rcf4-9wqw
- type: FIX
  url: https://github.com/tensorflow/tensorflow/commit/376c352a37ce5a68b721406dc7e77ac4b6cf483d
aliases:
- CVE-2021-29573
- GHSA-9vpm-rcf4-9wqw
modified: "2021-12-09T06:34:54.700321Z"
published: "2021-05-14T20:15:00Z"