CVE-2021-41228 log

Source	CVE Red Hat MITRE NVD Debian Ubuntu SUSE Alpine Mageia CVE Details CIRCL Bugs Arch Linux Red Hat Gentoo SUSE GitHub Lists oss-security full-disclosure bugtraq Misc GitHub code web search
Severity	High
Remote	No
Type	Arbitrary code execution
Description	In TensorFlow before version 2.6.1, TensorFlow's saved_model_cli tool is vulnerable to a code injection as it calls eval on user supplied strings. This can be used by attackers to run arbitrary code on the plaform where the CLI tool runs. However, given that the tool is always run manually, the impact of this is not severe. This was patched by adding a safe flag which defaults to True and an explicit warning for users.

Group	Package	Affected	Fixed	Severity	Status	Ticket
AVG-2529	tensorflow	2.6.0-6	2.6.1-1	High	Fixed

References
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-3rcw-9p9x-582v https://github.com/tensorflow/tensorflow/commit/8b202f08d52e8206af2bdb2112a62fafbc546ec7