Improper Input Validation in Google TensorFlow

Also known as GHSA-qx2v-j445-g354, PYSEC-2019-207, PYSEC-2019-225, PYSEC-2019-232

Published 7 y ago 2019-04-24 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.1

v3.0 · NVD

CISA KEV

not known exploited

EPSS

0.5%

percentile 44%

Public exploits

none known

Memcpy parameter overlap in Google Snappy library 1.1.4, as used in Google TensorFlow before 1.7.1, could result in a crash or read from other parts of process memory.

Exploit prediction (EPSS)

0.52% probability of exploitation in the next 30 days, higher than 44% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	8.1	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H`
NVD	2.0	5.8	`AV:N/AC:M/Au:N/C:P/I:N/A:P`
GitHub	3.0	8.1	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
pypi	`tensorflow`	>=1.1.0, <1.7.1 <1.7.1	1.7.1
pypi	`tensorflow-gpu`	>=1.1.0, <1.7.1 <1.7.1	1.7.1
pypi	`tensorflow-cpu`	<1.7.1	1.7.1

Classification

Weakness

CWE-20 Improper Input Validation

References

github.com /tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2018-005.md · x_refsource_CONFIRM, x_transferred
nvd.nist.gov /vuln/detail/CVE-2018-7577 · advisory
github.com /tensorflow/tensorflow/commit/dfa9921e6343727b05f42f8d4a918b19528ff994 · web
github.com /advisories/GHSA-qx2v-j445-g354 · advisory
github.com /pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2019-225.yaml · web
github.com /pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2019-232.yaml · web
github.com /pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2019-207.yaml · web
github.com /tensorflow/tensorflow · package

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.