CVE-2020-15203

Katalog CVE

CVSS 7.5 · High EPSS 0,97%

Kerentanan Improper Input Validation pada google tensorflow, opensuse leap. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the `fill` argument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a `printf` call is constructed. This may result in segmentation fault. The issue is patched in commit 33be22c65d86256e6826666662e40dbdfe70ee83, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Rincian

Terbit di NVD

25 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-134: Use of Externally-Controlled Format String

EPSS (30 hari)

0,97% peluang dieksploitasi; lebih tinggi dari 60,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/tensorflow/tensorflow/commit/33be22c65d86256e6826666662e40dbdfe70ee83 patch · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.html mailing list · advisory pihak ketiga
• https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1 advisory pihak ketiga
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xmq7-7fxm-rr79 exploit · advisory pihak ketiga