« Volver al listado

CVE-2021-37684

Estado: ModificadaMedia (5.5)—

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementations of pooling in TFLite are vulnerable to division by 0 errors as there are no checks for divisors not being 0. We have patched the issue in GitHub commit [dfa22b348b70bb89d6d6ec0ff53973bacb4f4695](https://github.com/tensorflow/tensorflow/commit/dfa22b348b70bb89d6d6ec0ff53973bacb4f4695). The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Google — Tensorflow

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-37684",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.1,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "tensorflow",
          "product": "tensorflow",
          "versions": [
            {
              "status": "affected",
              "version": ">= 2.5.0, < 2.5.1"
            },
            {
              "status": "affected",
              "version": ">= 2.4.0, < 2.4.3"
            },
            {
              "status": "affected",
              "version": "< 2.3.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-08-12T23:15:08.583",
  "references": [
    {
      "url": "https://github.com/tensorflow/tensorflow/security/advisories/GHSA-q7f7-544h-67h9",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/tensorflow/tensorflow/security/advisories/GHSA-q7f7-544h-67h9",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-369"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementations of pooling in TFLite are vulnerable to division by 0 errors as there are no checks for divisors not being 0. We have patched the issue in GitHub commit [dfa22b348b70bb89d6d6ec0ff53973bacb4f4695](https://github.com/tensorflow/tensorflow/commit/dfa22b348b70bb89d6d6ec0ff53973bacb4f4695). The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range."
    },
    {
      "lang": "es",
      "value": "TensorFlow es una plataforma de código abierto de extremo a extremo para el aprendizaje automático.&#xa0;En las versiones afectadas, las implementaciones de agrupación en TFLite son vulnerables a una división por 0, ya que no hay comprobaciones de que los divisores no sean 0. Hemos solucionado el problema en el commit de GitHub [dfa22b348b70bb89d6d6ec0ff53973bacb4f4695] (https://github.com/tensorflow/tensorflow / commit / dfa22b348b70bb89d6d6ec0ff53973bacb4f4695).&#xa0;La corrección será incluida en TensorFlow versión 2.6.0.&#xa0;También seleccionaremos este commit en TensorFlow versión 2.5.1, TensorFlow versión 2.4.3 y TensorFlow versión 2.3.4, ya que estos también están afectados y aún se encuentran en el rango admitido."
    }
  ],
  "lastModified": "2026-06-17T04:00:58.787",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0F83C081-51CC-415F-A8C0-0A44C75E2CD6",
              "versionEndExcluding": "2.3.4",
              "versionStartIncluding": "2.3.0"
            },
            {
              "criteria": "cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BD3F2BF8-EBA9-42BF-8F9B-D918B880B15A",
              "versionEndExcluding": "2.4.3",
              "versionStartIncluding": "2.4.0"
            },
            {
              "criteria": "cpe:2.3:a:google:tensorflow:2.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D03E99A7-4E3D-427D-A156-C0713E9FB02A"
            },
            {
              "criteria": "cpe:2.3:a:google:tensorflow:2.6.0:rc0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "70FA6E48-6C57-40CA-809F-4E3D07CBF348"
            },
            {
              "criteria": "cpe:2.3:a:google:tensorflow:2.6.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "42187561-E491-434D-828C-F36701446634"
            },
            {
              "criteria": "cpe:2.3:a:google:tensorflow:2.6.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C66B61C8-450A-4C5E-9174-F970D6DEE778"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}