---

CVE-2020-15265 - log back

CVE-2020-15265 edited at 11 Dec 2020 15:27:28
Severity	- Unknown + Medium
Remote	- Unknown + Local
Type	- Unknown + Denial of service
Description	+ In Tensorflow before version 2.4.0, an attacker can pass an invalid axis value to tf.quantization.quantize_and_dequantize. This results in accessing a dimension outside the rank of the input tensor in the C++ kernel implementation. However, dim_size only does a DCHECK to validate the argument and then uses it to access the corresponding element of an array. Since in normal builds, DCHECK-like macros are no-ops, this results in segfault and access out of bounds of the array.
References	+ https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rrfp-j2mp-hq9c + https://github.com/tensorflow/tensorflow/issues/42105 + https://github.com/tensorflow/tensorflow/commit/eccb7ec454e6617738554a255d77f08e60ee0808
Notes

CVE-2020-15265 created at 11 Dec 2020 15:25:12