id: PYSEC-2021-406
details: TensorFlow is an open source platform for machine learning. In affected versions
  the shape inference code for `tf.ragged.cross` has an undefined behavior due to
  binding a reference to `nullptr`. The fix will be included in TensorFlow 2.7.0.
  We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow
  2.4.4, as these are also affected and still in supported range.
affected:
- package:
    name: tensorflow
    ecosystem: PyPI
    purl: pkg:pypi/tensorflow
  ranges:
  - type: GIT
    repo: https://github.com/tensorflow/tensorflow
    events:
    - introduced: "0"
    - fixed: fa6b7782fbb14aa08d767bc799c531f5e1fb3bb8
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.4.4
    - introduced: 2.5.0
    - fixed: 2.5.2
    - introduced: 2.6.0
    - fixed: 2.6.1
    - introduced: 2.7.0rc0
    - fixed: 2.7.0
  versions:
  - 0.12.0
  - 0.12.1
  - 1.0.0
  - 1.0.1
  - 1.1.0
  - 1.10.0
  - 1.10.1
  - 1.11.0
  - 1.12.0
  - 1.12.2
  - 1.12.3
  - 1.13.1
  - 1.13.2
  - 1.14.0
  - 1.15.0
  - 1.15.2
  - 1.15.3
  - 1.15.4
  - 1.15.5
  - 1.2.0
  - 1.2.1
  - 1.3.0
  - 1.4.0
  - 1.4.1
  - 1.5.0
  - 1.5.1
  - 1.6.0
  - 1.7.0
  - 1.7.1
  - 1.8.0
  - 1.9.0
  - 2.0.0
  - 2.0.1
  - 2.0.2
  - 2.0.3
  - 2.0.4
  - 2.1.0
  - 2.1.1
  - 2.1.2
  - 2.1.3
  - 2.1.4
  - 2.2.0
  - 2.2.0rc0
  - 2.2.0rc1
  - 2.2.0rc2
  - 2.2.0rc3
  - 2.2.0rc4
  - 2.2.1
  - 2.2.2
  - 2.2.3
  - 2.3.0
  - 2.3.0rc0
  - 2.3.0rc1
  - 2.3.0rc2
  - 2.3.1
  - 2.3.2
  - 2.3.3
  - 2.3.4
  - 2.4.0
  - 2.4.0rc0
  - 2.4.0rc1
  - 2.4.0rc2
  - 2.4.0rc3
  - 2.4.0rc4
  - 2.4.1
  - 2.4.2
  - 2.4.3
  - 2.5.0
  - 2.5.1
  - 2.6.0
  - 2.7.0rc0
  - 2.7.0rc1
references:
- type: ADVISORY
  url: https://github.com/tensorflow/tensorflow/security/advisories/GHSA-vwhq-49r4-gj9v
- type: FIX
  url: https://github.com/tensorflow/tensorflow/commit/fa6b7782fbb14aa08d767bc799c531f5e1fb3bb8
aliases:
- CVE-2021-41214
- GHSA-vwhq-49r4-gj9v
modified: "2021-11-13T06:52:44.328170Z"
published: "2021-11-05T21:15:00Z"