CVE-2022-23590

描述

Tensorflow is an Open Source Machine Learning Framework. A `GraphDef` from a TensorFlow `SavedModel` can be maliciously altered to cause a TensorFlow process to crash due to encountering a `StatusOr` value that is an error and forcibly extracting the value from it. We have patched the issue in multiple GitHub commits and these will be included in TensorFlow 2.8.0 and TensorFlow 2.7.1, as both are affected.

如何修補 CVE-2022-23590

要修補 CVE-2022-23590,請將受影響套件升級到下列已修補版本。

• —升級至 2.7.1 或更新版本
• —升級至 2.7.1 或更新版本
• —升級至 2.7.1 或更新版本
• —升級至 2.7.1 或更新版本
• —升級至 955059813cc325dc1db5e2daa6221271406d4439 或更新版本
• —升級至 2.7.1 或更新版本
• —升級至 955059813cc325dc1db5e2daa6221271406d4439 或更新版本

CVE-2022-23590 正在被利用嗎?

低 — EPSS 為 1.0%,目前沒有觀察到大規模利用活動。

受影響套件(7)

• from 0, < 2.7.1
• from 0, < 2.7.1
• from 0, < 2.7.1
• from 0, < 2.7.1
• from 0, < 955059813cc325dc1db5e2daa6221271406d4439 | from 0, < 2.7.1
• from 0, < 2.7.1
• from 0, < 955059813cc325dc1db5e2daa6221271406d4439 | from 0, < 2.7.1

CVSS 分數

參考連結(9)

• ADVISORYgithub.com/advisories/GHSA-pqrv-8r2f-7278
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-23590
• PATCHpypi.org/project/tensorflow
• WEBgithub.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-99.yaml