CVE-2023-25662

Advisory

Tensorflow 2.11.1 and 2.12.0 include a fix for CVE-2023-25662: Versions prior to 2.12.0 and 2.11.1 are vulnerable to integer overflow in EditDistance.
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-7jvm-xxmr-v5cw

Affected package

Affected versions

Fixed versions

Vulnerability changelog

TensorFlow is an open source platform for machine learning. Versions prior to 2.12.0 and 2.11.1 are vulnerable to integer overflow in EditDistance. A fix is included in TensorFlow version 2.12.0 and version 2.11.1. See CVE-2023-25662.


MISC:https://github.com/tensorflow/tensorflow/commit/08b8e18643d6dcde00890733b270ff8d9960c56c: https://github.com/tensorflow/tensorflow/commit/08b8e18643d6dcde00890733b270ff8d9960c56c
MISC:https://github.com/tensorflow/tensorflow/security/advisories/GHSA-7jvm-xxmr-v5cw: https://github.com/tensorflow/tensorflow/security/advisories/GHSA-7jvm-xxmr-v5cw

Resources

• https://github.com/tensorflow/tensorflow/commit/08b8e18643d6dcde00890733b270ff8d9960c56c
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-7jvm-xxmr-v5cw
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25662