---

CVE-2021-37658 - log back

CVE-2021-37658 created at 13 Aug 2021 07:57:59
Severity	+ Low
Remote	+ Local
Type	+ Information disclosure
Description	+ In TensorFlow before version 2.6.0 an attacker can cause undefined behavior via binding a reference to null pointer in all operations of type tf.raw_ops.MatrixSetDiagV*. The implementation has incomplete validation that the value of k is a valid tensor. There is a check that this value is either a scalar or a vector, but there is no check for the number of elements. If this is an empty tensor, then code that accesses the first element of the tensor is wrong.
References	+ https://github.com/tensorflow/tensorflow/security/advisories/GHSA-6p5r-g9mq-ggh2 + https://github.com/tensorflow/tensorflow/commit/ff8894044dfae5568ecbf2ed514c1a37dc394f1b
Notes