id: PYSEC-2021-807
details: TensorFlow is an open source platform for machine learning. In affected versions
  if `tf.image.resize` is called with a large input argument then the TensorFlow process
  will crash due to a `CHECK`-failure caused by an overflow. The number of elements
  in the output tensor is too much for the `int64_t` type and the overflow is detected
  via a `CHECK` statement. This aborts the process. The fix will be included in TensorFlow
  2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2,
  and TensorFlow 2.4.4, as these are also affected and still in supported range.
affected:
- package:
    name: tensorflow-gpu
    ecosystem: PyPI
    purl: pkg:pypi/tensorflow-gpu
  ranges:
  - type: GIT
    repo: https://github.com/tensorflow/tensorflow
    events:
    - introduced: "0"
    - fixed: e5272d4204ff5b46136a1ef1204fc00597e21837
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.4.4
    - introduced: 2.5.0
    - fixed: 2.5.2
    - introduced: 2.6.0
    - fixed: 2.6.1
    - introduced: 2.7.0rc0
    - fixed: 2.7.0
  versions:
  - 0.12.0
  - 0.12.1
  - 1.0.0
  - 1.0.1
  - 1.1.0
  - 1.10.0
  - 1.10.1
  - 1.11.0
  - 1.12.0
  - 1.12.2
  - 1.12.3
  - 1.13.1
  - 1.13.2
  - 1.14.0
  - 1.15.0
  - 1.15.2
  - 1.15.3
  - 1.15.4
  - 1.15.5
  - 1.2.0
  - 1.2.1
  - 1.3.0
  - 1.4.0
  - 1.4.1
  - 1.5.0
  - 1.5.1
  - 1.6.0
  - 1.7.0
  - 1.7.1
  - 1.8.0
  - 1.9.0
  - 2.0.0
  - 2.0.1
  - 2.0.2
  - 2.0.3
  - 2.0.4
  - 2.1.0
  - 2.1.1
  - 2.1.2
  - 2.1.3
  - 2.1.4
  - 2.2.0
  - 2.2.1
  - 2.2.2
  - 2.2.3
  - 2.3.0
  - 2.3.1
  - 2.3.2
  - 2.3.3
  - 2.3.4
  - 2.4.0
  - 2.4.1
  - 2.4.2
  - 2.4.3
  - 2.5.0
  - 2.5.1
  - 2.6.0
  - 2.7.0rc0
  - 2.7.0rc1
references:
- type: ADVISORY
  url: https://github.com/tensorflow/tensorflow/security/advisories/GHSA-5hx2-qx8j-qjqm
- type: REPORT
  url: https://github.com/tensorflow/tensorflow/issues/46914
- type: FIX
  url: https://github.com/tensorflow/tensorflow/commit/e5272d4204ff5b46136a1ef1204fc00597e21837
aliases:
- CVE-2021-41199
- GHSA-5hx2-qx8j-qjqm
modified: "2021-12-09T06:35:41.080668Z"
published: "2021-11-05T20:15:00Z"