PT-2019-11100 · Google · Tensorflow+1

Publicado 2019-04-24 · Atualizado 2019-04-30 · CVE-2018-7577

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Google Snappy library version 1.1.4 Google TensorFlow versions prior to 1.7.1

Description: The issue is related to a memcpy parameter overlap in the Google Snappy library, which could result in a crash or allow reading from other parts of the process memory.

Recommendations: For Google Snappy library version 1.1.4, update to a version later than 1.1.4 to resolve the issue. For Google TensorFlow versions prior to 1.7.1, update to version 1.7.1 or later to fix the problem.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-7577

GHSA-QX2V-J445-G354

PYSEC-2019-207

PYSEC-2019-225

PYSEC-2019-232

Produtos afetados

Google Snappy

Tensorflow

Referências · 13

• https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2018-005.md · Nota
• https://github.com/tensorflow/tensorflow/commit/dfa9921e6343727b05f42f8d4a918b19528ff994 · Nota
• https://github.com/tensorflow/tensorflow · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2019-207.yaml · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2019-232.yaml · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2019-225.yaml · Nota
• https://osv.dev/vulnerability/PYSEC-2019-225 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-7577 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2019-232 · Aviso do Fabricante
• https://github.com/advisories/GHSA-qx2v-j445-g354 · Nota
• https://osv.dev/vulnerability/CVE-2018-7577 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2019-207 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-qx2v-j445-g354 · Aviso do Fabricante