---

CVE-2021-37657 - log back

CVE-2021-37657 created at 13 Aug 2021 07:58:00
Severity	+ Low
Remote	+ Local
Type	+ Insufficient validation
Description	+ In TensorFlow before version 2.6.0 an attacker can cause undefined behavior via binding a reference to null pointer in all operations of type tf.raw_ops.MatrixDiagV*. The implementation has incomplete validation that the value of k is a valid tensor. There is a check that this value is either a scalar or a vector, but there is no check for the number of elements. If this is an empty tensor, then code that accesses the first element of the tensor is wrong.
References	+ https://github.com/tensorflow/tensorflow/security/advisories/GHSA-5xwc-mrhx-5g3m + https://github.com/tensorflow/tensorflow/commit/f2a673bd34f0d64b8e40a551ac78989d16daad09
Notes