Detections
Analytics
SCA: security update for tensorflow, tensorflow-cpu, tensorflow-gpu (GHSA-qg48-85hg-mqc5)
low Tenable Cloud Security Plugin ID 418108
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of
service via a FPE runtime error in `tf.raw_ops.DenseCountSparseOutput`. This is because the implementation
(https://github.com/tensorflow/tensorflow/blob/efff014f3b2d8ef6141da30c806faf141297eca1/tensorflow/core/ke
rnels/count_ops.cc#L123-L127) computes a divisor value from user data but does not check that the result
is 0 before doing the division. Since `data` is given by the `values` argument, `num_batch_elements` is 0.
The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, and
TensorFlow 2.3.3, as these are also affected. (CVE-2021-29554)
See Also
Plugin Details
Severity: Low
ID: 418108
Version: Revision 1.5
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.18
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: Low
Base Score: 2.1
Temporal Score: 1.6
Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P
CVSS Score Source: CVE-2021-29554
CVSS v3
Risk Factor: Medium
Base Score: 5.5
Temporal Score: 5
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS v4
Risk Factor: Low
Base Score: 2
Threat Score: 1.1
Threat Vector: CVSS:4.0/E:P
Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 5/21/2021
Vulnerability Publication Date: 5/14/2021
Reference Information
CVE: CVE-2021-29554
cwe: CWE-369