Detections
Analytics

SCA: security update for tensorflow, tensorflow-cpu, tensorflow-gpu (GHSA-95xm-g58g-3p88)

medium Tenable Self-Hosted Container Security Plugin ID 413068

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - TensorFlow is an end-to-end open source platform for machine learning. In affected versions the
 implementation of `tf.raw_ops.SparseReshape` can be made to trigger an integral division by 0 exception.
 The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f4969
 8/tensorflow/core/kernels/reshape_util.cc#L176-L181) calls the reshaping functor whenever there is at
 least an index in the input but does not check that shape of the input or the target shape have both a
 non-zero number of elements. The [reshape functor](https://github.com/tensorflow/tensorflow/blob/8d72537c6
 abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/reshape_util.cc#L40-L78) blindly divides by the
 dimensions of the target shape. Hence, if this is not checked, code will result in a division by 0. We
 have patched the issue in GitHub commit 4923de56ec94fff7770df259ab7f2288a74feb41. The fix will be included
 in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1 as this is the other affected
 version. (CVE-2021-37640)

See Also

https://github.com/advisories/GHSA-95xm-g58g-3p88

Plugin Details

Severity: Medium

ID: 413068

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Low

Base Score: 2.1

Temporal Score: 1.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2021-37640

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 5.7

Threat Score: 1.9

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/25/2021

Vulnerability Publication Date: 8/12/2021

Reference Information

CVE: CVE-2021-37640

cwe: CWE-369