---

CVE-2021-37674 - log back

CVE-2021-37674 created at 13 Aug 2021 07:57:58
Severity	+ Medium
Remote	+ Local
Type	+ Denial of service
Description	+ In TensorFlow before version 2.6.0 an attacker can trigger a denial of service via a segmentation fault in tf.raw_ops.MaxPoolGrad caused by missing validation. The implementation misses some validation for the orig_input and orig_output tensors. The fixes for CVE-2021-29579 were incomplete.
References	+ https://github.com/tensorflow/tensorflow/security/advisories/GHSA-7ghq-fvr3-pj2x + https://github.com/tensorflow/tensorflow/commit/136b51f10903e044308cf77117c0ed9871350475
Notes