id: PYSEC-2021-613
details: TensorFlow is an open source platform for machine learning. In affected versions
  an attacker can trigger undefined behavior, integer overflows, segfaults and `CHECK`-fail
  crashes if they can change saved checkpoints from outside of TensorFlow. This is
  because the checkpoints loading infrastructure is missing validation for invalid
  file formats. The fixes will be included in TensorFlow 2.7.0. We will also cherrypick
  these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these
  are also affected and still in supported range.
affected:
- package:
    name: tensorflow-cpu
    ecosystem: PyPI
    purl: pkg:pypi/tensorflow-cpu
  ranges:
  - type: GIT
    repo: https://github.com/tensorflow/tensorflow
    events:
    - introduced: "0"
    - fixed: 368af875869a204b4ac552b9ddda59f6a46a56ec
    - fixed: abcced051cb1bd8fb05046ac3b6023a7ebcc4578
    - fixed: e8dc63704c88007ee4713076605c90188d66f3d2
    - fixed: b619c6f865715ca3b15ef1842b5b95edbaa710ad
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.4.4
    - introduced: 2.5.0
    - fixed: 2.5.2
    - introduced: 2.6.0
    - fixed: 2.6.1
    - introduced: 2.7.0rc0
    - fixed: 2.7.0
  versions:
  - 1.15.0
  - 2.1.0
  - 2.1.1
  - 2.1.2
  - 2.1.3
  - 2.1.4
  - 2.2.0
  - 2.2.1
  - 2.2.2
  - 2.2.3
  - 2.3.0
  - 2.3.1
  - 2.3.2
  - 2.3.3
  - 2.3.4
  - 2.4.0
  - 2.4.1
  - 2.4.2
  - 2.4.3
  - 2.5.0
  - 2.5.1
  - 2.6.0
  - 2.7.0rc0
  - 2.7.0rc1
references:
- type: ADVISORY
  url: https://github.com/tensorflow/tensorflow/security/advisories/GHSA-7pxj-m4jf-r6h2
- type: FIX
  url: https://github.com/tensorflow/tensorflow/commit/368af875869a204b4ac552b9ddda59f6a46a56ec
- type: FIX
  url: https://github.com/tensorflow/tensorflow/commit/abcced051cb1bd8fb05046ac3b6023a7ebcc4578
- type: FIX
  url: https://github.com/tensorflow/tensorflow/commit/e8dc63704c88007ee4713076605c90188d66f3d2
- type: FIX
  url: https://github.com/tensorflow/tensorflow/commit/b619c6f865715ca3b15ef1842b5b95edbaa710ad
aliases:
- CVE-2021-41203
- GHSA-7pxj-m4jf-r6h2
modified: "2021-12-09T06:35:08.067216Z"
published: "2021-11-05T21:15:00Z"