id: PYSEC-2021-400
details: TensorFlow is an open source platform for machine learning. In affected versions
  the code for boosted trees in TensorFlow is still missing validation. As a result,
  attackers can trigger denial of service (via dereferencing `nullptr`s or via `CHECK`-failures)
  as well as abuse undefined behavior (binding references to `nullptr`s). An attacker
  can also read and write from heap buffers, depending on the API that gets used and
  the arguments that are passed to the call. Given that the boosted trees implementation
  in TensorFlow is unmaintained, it is recommend to no longer use these APIs. We will
  deprecate TensorFlow's boosted trees APIs in subsequent releases. The fix will be
  included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow
  2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still
  in supported range.
affected:
- package:
    name: tensorflow
    ecosystem: PyPI
    purl: pkg:pypi/tensorflow
  ranges:
  - type: GIT
    repo: https://github.com/tensorflow/tensorflow
    events:
    - introduced: "0"
    - fixed: 5c8c9a8bfe750f9743d0c859bae112060b216f5c
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.4.4
    - introduced: 2.5.0
    - fixed: 2.5.2
    - introduced: 2.6.0
    - fixed: 2.6.1
    - introduced: 2.7.0rc0
    - fixed: 2.7.0
  versions:
  - 0.12.0
  - 0.12.1
  - 1.0.0
  - 1.0.1
  - 1.1.0
  - 1.10.0
  - 1.10.1
  - 1.11.0
  - 1.12.0
  - 1.12.2
  - 1.12.3
  - 1.13.1
  - 1.13.2
  - 1.14.0
  - 1.15.0
  - 1.15.2
  - 1.15.3
  - 1.15.4
  - 1.15.5
  - 1.2.0
  - 1.2.1
  - 1.3.0
  - 1.4.0
  - 1.4.1
  - 1.5.0
  - 1.5.1
  - 1.6.0
  - 1.7.0
  - 1.7.1
  - 1.8.0
  - 1.9.0
  - 2.0.0
  - 2.0.1
  - 2.0.2
  - 2.0.3
  - 2.0.4
  - 2.1.0
  - 2.1.1
  - 2.1.2
  - 2.1.3
  - 2.1.4
  - 2.2.0
  - 2.2.0rc0
  - 2.2.0rc1
  - 2.2.0rc2
  - 2.2.0rc3
  - 2.2.0rc4
  - 2.2.1
  - 2.2.2
  - 2.2.3
  - 2.3.0
  - 2.3.0rc0
  - 2.3.0rc1
  - 2.3.0rc2
  - 2.3.1
  - 2.3.2
  - 2.3.3
  - 2.3.4
  - 2.4.0
  - 2.4.0rc0
  - 2.4.0rc1
  - 2.4.0rc2
  - 2.4.0rc3
  - 2.4.0rc4
  - 2.4.1
  - 2.4.2
  - 2.4.3
  - 2.5.0
  - 2.5.1
  - 2.6.0
  - 2.7.0rc0
  - 2.7.0rc1
references:
- type: FIX
  url: https://github.com/tensorflow/tensorflow/commit/5c8c9a8bfe750f9743d0c859bae112060b216f5c
- type: ADVISORY
  url: https://github.com/tensorflow/tensorflow/security/advisories/GHSA-57wx-m983-2f88
aliases:
- CVE-2021-41208
- GHSA-57wx-m983-2f88
modified: "2021-11-13T06:52:43.429056Z"
published: "2021-11-05T22:15:00Z"