Detections
Analytics

SCA: security update for tensorflow, tensorflow-cpu, tensorflow-gpu (GHSA-q263-fvxm-m5mw)

medium Tenable Cloud Security Plugin ID 417792

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In affected versions of TensorFlow under certain cases, loading a saved model can result in accessing
 uninitialized memory while building the computation graph. The MakeEdge function creates an edge between
 one output tensor of the src node (given by output_index) and the input slot of the dst node (given by
 input_index). This is only possible if the types of the tensors on both sides coincide, so the function
 begins by obtaining the corresponding DataType values and comparing these for equality. However, there is
 no check that the indices point to inside of the arrays they index into. Thus, this can result in
 accessing data out of bounds of the corresponding heap allocated arrays. In most scenarios, this can
 manifest as unitialized data access, but if the index points far away from the boundaries of the arrays
 this can be used to leak addresses from the library. This is fixed in versions 1.15.5, 2.0.4, 2.1.3,
 2.2.2, 2.3.2, and 2.4.0. (CVE-2020-26271)

See Also

https://github.com/advisories/GHSA-q263-fvxm-m5mw

Plugin Details

Severity: Medium

ID: 417792

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Low

Base Score: 2.1

Temporal Score: 1.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2020-26271

CVSS v3

Risk Factor: Low

Base Score: 3.3

Temporal Score: 3

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 4.8

Threat Score: 1.9

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/10/2020

Vulnerability Publication Date: 12/10/2020

Reference Information

CVE: CVE-2020-26271