PT-2019-11100 · Google · Tensorflow+1

Published 2019-04-24 · Updated 2019-04-30 · CVE-2018-7577

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Google Snappy library version 1.1.4 Google TensorFlow versions prior to 1.7.1

Description: The issue is related to a memcpy parameter overlap in the Google Snappy library, which could result in a crash or allow reading from other parts of the process memory.

Recommendations: For Google Snappy library version 1.1.4, update to a version later than 1.1.4 to resolve the issue. For Google TensorFlow versions prior to 1.7.1, update to version 1.7.1 or later to fix the problem.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-7577

GHSA-QX2V-J445-G354

PYSEC-2019-207

PYSEC-2019-225

PYSEC-2019-232

Affected Products

Google Snappy

Tensorflow

References · 13

• https://osv.dev/vulnerability/PYSEC-2019-225 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-7577 · Security Note
• https://osv.dev/vulnerability/PYSEC-2019-232 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-7577 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-207 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qx2v-j445-g354 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2018-005.md · Note
• https://github.com/tensorflow/tensorflow/commit/dfa9921e6343727b05f42f8d4a918b19528ff994 · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2019-207.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2019-232.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2019-225.yaml · Note
• https://github.com/advisories/GHSA-qx2v-j445-g354 · Note