id: PYSEC-2021-619
details: TensorFlow is an open source platform for machine learning. In affected versions
  the shape inference functions for `SparseCountSparseOutput` can trigger a read outside
  of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0.
  We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow
  2.4.4, as these are also affected and still in supported range.
affected:
- package:
    name: tensorflow-cpu
    ecosystem: PyPI
    purl: pkg:pypi/tensorflow-cpu
  ranges:
  - type: GIT
    repo: https://github.com/tensorflow/tensorflow
    events:
    - introduced: "0"
    - fixed: 701cfaca222a82afbeeb17496bd718baa65a67d2
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.4.4
    - introduced: 2.5.0
    - fixed: 2.5.2
    - introduced: 2.6.0
    - fixed: 2.6.1
    - introduced: 2.7.0rc0
    - fixed: 2.7.0
  versions:
  - 1.15.0
  - 2.1.0
  - 2.1.1
  - 2.1.2
  - 2.1.3
  - 2.1.4
  - 2.2.0
  - 2.2.1
  - 2.2.2
  - 2.2.3
  - 2.3.0
  - 2.3.1
  - 2.3.2
  - 2.3.3
  - 2.3.4
  - 2.4.0
  - 2.4.1
  - 2.4.2
  - 2.4.3
  - 2.5.0
  - 2.5.1
  - 2.6.0
  - 2.7.0rc0
  - 2.7.0rc1
references:
- type: FIX
  url: https://github.com/tensorflow/tensorflow/commit/701cfaca222a82afbeeb17496bd718baa65a67d2
- type: ADVISORY
  url: https://github.com/tensorflow/tensorflow/security/advisories/GHSA-m342-ff57-4jcc
aliases:
- CVE-2021-41210
- GHSA-m342-ff57-4jcc
modified: "2021-12-09T06:35:08.976231Z"
published: "2021-11-05T20:15:00Z"