openSUSE Security Update : tensorflow2 (openSUSE-2020-1766)

critical Nessus Plugin ID 142135

Language:

Synopsis

The remote openSUSE host is missing a security update.

Description

This update for tensorflow2 fixes the following issues :

- updated to 2.1.2 with following fixes (boo#1177022) :

- Fixes an undefined behavior causing a segfault in tf.raw_ops.Switch (CVE-2020-15190)

- Fixes three vulnerabilities in conversion to DLPack format (CVE-2020-15191, CVE-2020-15192, CVE-2020-15193)

- Fixes two vulnerabilities in SparseFillEmptyRowsGrad (CVE-2020-15194, CVE-2020-15195)

- Fixes an integer truncation vulnerability in code using the work sharder API (CVE-2020-15202)

- Fixes a format string vulnerability in tf.strings.as_string (CVE-2020-15203)

- Fixes segfault raised by calling session-only ops in eager mode (CVE-2020-15204)

- Fixes data leak and potential ASLR violation from tf.raw_ops.StringNGrams (CVE-2020-15205)

- Fixes segfaults caused by incomplete SavedModel validation (CVE-2020-15206)

- Fixes a data corruption due to a bug in negative indexing support in TFLite (CVE-2020-15207)

- Fixes a data corruption due to dimension mismatch in TFLite (CVE-2020-15208)

- Fixes several vulnerabilities in TFLite saved model format (CVE-2020-15209, CVE-2020-15210, CVE-2020-15211)

Solution

Update the affected tensorflow2 packages.

Plugin Details

Severity: Critical

ID: 142135

File Name: openSUSE-2020-1766.nasl

Version: 1.3

Type: local

Agent: unix

Family: SuSE Local Security Checks

Published: 10/30/2020

Updated: 2/13/2024

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.3

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2020-15208

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:libtensorflow_framework2-debuginfo, p-cpe:/a:novell:opensuse:tensorflow2-lite-debugsource, p-cpe:/a:novell:opensuse:libtensorflow2-debuginfo, p-cpe:/a:novell:opensuse:tensorflow2-gnu-openmpi2-hpc, p-cpe:/a:novell:opensuse:tensorflow2-debuginfo, p-cpe:/a:novell:opensuse:tensorflow2-gnu-hpc, p-cpe:/a:novell:opensuse:tensorflow2, p-cpe:/a:novell:opensuse:tensorflow2_2_1_2-gnu-openmpi2-hpc-debuginfo, p-cpe:/a:novell:opensuse:tensorflow2-debugsource, p-cpe:/a:novell:opensuse:tensorflow2_2_1_2-gnu-hpc, p-cpe:/a:novell:opensuse:libtensorflow_framework2-gnu-hpc-debuginfo, p-cpe:/a:novell:opensuse:libtensorflow2-gnu-openmpi2-hpc-debuginfo, p-cpe:/a:novell:opensuse:tensorflow2-lite, p-cpe:/a:novell:opensuse:libtensorflow_cc2-gnu-hpc, p-cpe:/a:novell:opensuse:libtensorflow_cc2, p-cpe:/a:novell:opensuse:libtensorflow_cc2-debuginfo, p-cpe:/a:novell:opensuse:tensorflow2_2_1_2-gnu-hpc-debugsource, p-cpe:/a:novell:opensuse:tensorflow2_2_1_2-gnu-hpc-debuginfo, p-cpe:/a:novell:opensuse:libtensorflow_framework2-gnu-hpc, p-cpe:/a:novell:opensuse:libtensorflow_cc2-gnu-openmpi2-hpc-debuginfo, p-cpe:/a:novell:opensuse:tensorflow2_2_1_2-gnu-openmpi2-hpc, p-cpe:/a:novell:opensuse:libtensorflow_framework2-gnu-openmpi2-hpc-debuginfo, p-cpe:/a:novell:opensuse:tensorflow2_2_1_2-gnu-hpc-devel, p-cpe:/a:novell:opensuse:tensorflow2_2_1_2-gnu-openmpi2-hpc-debugsource, p-cpe:/a:novell:opensuse:libtensorflow_framework2, p-cpe:/a:novell:opensuse:libtensorflow_cc2-gnu-hpc-debuginfo, p-cpe:/a:novell:opensuse:tensorflow2-devel, p-cpe:/a:novell:opensuse:libtensorflow2-gnu-openmpi2-hpc, p-cpe:/a:novell:opensuse:tensorflow2-lite-debuginfo, p-cpe:/a:novell:opensuse:tensorflow2-lite-devel, p-cpe:/a:novell:opensuse:libtensorflow2-gnu-hpc-debuginfo, p-cpe:/a:novell:opensuse:libtensorflow2-gnu-hpc, p-cpe:/a:novell:opensuse:libtensorflow_framework2-gnu-openmpi2-hpc, p-cpe:/a:novell:opensuse:libtensorflow2, cpe:/o:novell:opensuse:15.2, p-cpe:/a:novell:opensuse:libtensorflow_cc2-gnu-openmpi2-hpc, p-cpe:/a:novell:opensuse:tensorflow2_2_1_2-gnu-openmpi2-hpc-devel

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/29/2020

Vulnerability Publication Date: 9/25/2020

Reference Information

CVE: CVE-2020-15190, CVE-2020-15191, CVE-2020-15192, CVE-2020-15193, CVE-2020-15194, CVE-2020-15195, CVE-2020-15202, CVE-2020-15203, CVE-2020-15204, CVE-2020-15205, CVE-2020-15206, CVE-2020-15207, CVE-2020-15208, CVE-2020-15209, CVE-2020-15210, CVE-2020-15211

Detections

Analytics