Skip to main content

Improper Input Validation

CVE-2020-26270

Low
3.3/10

Summary

TensorFlow before 1.15.5, 2.0.0 through 2.0.3, 2.1.0 through 2.1.2, 2.2.0 through 2.2.1, and 2.3.0 through 2.3.1, running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a CHECK failure when using the CUDA backend. This can result in a query-of-death vulnerability, via denial of service, if users can control the input to the layer. This also affects tensorflow-cpu and tensorflow-gpu packages. It's fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.

  • LOW
  • LOCAL
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • NONE
  • LOW

CWE-20 - Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

Advisory Timeline

  • Published