id: PYSEC-2020-254
details: In affected versions of TensorFlow under certain cases a saved model can
  trigger use of uninitialized values during code execution. This is caused by having
  tensor buffers be filled with the default value of the type but forgetting to default
  initialize the quantized floating point types in Eigen. This is fixed in versions
  1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.
affected:
- package:
    name: tensorflow
    ecosystem: PyPI
    purl: pkg:pypi/tensorflow
  ranges:
  - type: GIT
    repo: https://github.com/tensorflow/tensorflow
    events:
    - introduced: "0"
    - fixed: ace0c15a22f7f054abcc1f53eabbcb0a1239a9e2
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.15.5
    - introduced: 2.0.0
    - fixed: 2.0.4
    - introduced: 2.1.0
    - fixed: 2.1.3
    - introduced: 2.2.0
    - fixed: 2.2.2
    - introduced: 2.3.0
    - fixed: 2.3.2
  versions:
  - 0.12.0
  - 0.12.0rc0
  - 0.12.0rc1
  - 0.12.1
  - 1.0.0
  - 1.0.1
  - 1.1.0
  - 1.1.0rc0
  - 1.1.0rc1
  - 1.1.0rc2
  - 1.10.0
  - 1.10.0rc0
  - 1.10.0rc1
  - 1.10.1
  - 1.11.0
  - 1.11.0rc0
  - 1.11.0rc1
  - 1.11.0rc2
  - 1.12.0
  - 1.12.0rc0
  - 1.12.0rc1
  - 1.12.0rc2
  - 1.12.2
  - 1.12.3
  - 1.13.0rc0
  - 1.13.0rc1
  - 1.13.0rc2
  - 1.13.1
  - 1.13.2
  - 1.14.0
  - 1.14.0rc0
  - 1.14.0rc1
  - 1.15.0
  - 1.15.0rc0
  - 1.15.0rc1
  - 1.15.0rc2
  - 1.15.0rc3
  - 1.15.2
  - 1.15.3
  - 1.15.4
  - 1.2.0
  - 1.2.0rc0
  - 1.2.0rc1
  - 1.2.0rc2
  - 1.2.1
  - 1.3.0
  - 1.3.0rc0
  - 1.3.0rc1
  - 1.3.0rc2
  - 1.4.0
  - 1.4.0rc0
  - 1.4.0rc1
  - 1.4.1
  - 1.5.0
  - 1.5.0rc0
  - 1.5.0rc1
  - 1.5.1
  - 1.6.0
  - 1.6.0rc0
  - 1.6.0rc1
  - 1.7.0
  - 1.7.0rc0
  - 1.7.0rc1
  - 1.7.1
  - 1.8.0
  - 1.8.0rc0
  - 1.8.0rc1
  - 1.9.0
  - 1.9.0rc0
  - 1.9.0rc1
  - 1.9.0rc2
  - 2.0.0
  - 2.0.1
  - 2.0.2
  - 2.0.3
  - 2.1.0
  - 2.1.1
  - 2.1.2
  - 2.2.0
  - 2.2.1
  - 2.3.0
  - 2.3.1
references:
- type: FIX
  url: https://github.com/tensorflow/tensorflow/commit/ace0c15a22f7f054abcc1f53eabbcb0a1239a9e2
- type: ADVISORY
  url: https://github.com/tensorflow/tensorflow/security/advisories/GHSA-qhxx-j73r-qpm2
aliases:
- CVE-2020-26266
- GHSA-qhxx-j73r-qpm2
modified: "2021-08-27T03:22:22.698179Z"
published: "2020-12-10T23:15:00Z"