Remote No

Type Denial of service

Description

A security issue has been found in TensorFlow before version 2.4.2. The implementation of `ParseAttrValue`(https://github.com/tensorflow/tensorflow/blob/c22d88d6ff33031aa113e48aa3fc9aa74ed79595/tensorflow/core/framework/attr_value_util.cc#L397-L453) can be tricked into stack overflow due to recursion by giving in a specially crafted input.

AVG-1962 tensorflow 2.4.1-10 Critical Vulnerable

https://github.com/tensorflow/tensorflow/security/advisories/GHSA-qw5h-7f53-xrp6
https://github.com/tensorflow/tensorflow/commit/e07e1c3d26492c06f078c7e5bf2d138043e199c1