CVE-2020-15205: Data leak in Tensorflow
9.1
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.66785%
CWE
Published
9/25/2020
Updated
10/30/2024
KEV Status
No
Technology
Python
PythonTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tensorflow | pip | < 1.15.4 | 1.15.4 |
| tensorflow | pip | >= 2.0.0, < 2.0.3 | 2.0.3 |
| tensorflow | pip | >= 2.1.0, < 2.1.2 | 2.1.2 |
| tensorflow | pip | = 2.2.0 | 2.2.1 |
| tensorflow | pip | = 2.3.0 | 2.3.1 |
| tensorflow-cpu | pip | < 1.15.4 | 1.15.4 |
| tensorflow-cpu | pip | >= 2.0.0, < 2.0.3 | 2.0.3 |
| tensorflow-cpu | pip | >= 2.1.0, < 2.1.2 | 2.1.2 |
| tensorflow-cpu | pip | = 2.2.0 | 2.2.1 |
| tensorflow-cpu | pip | = 2.3.0 | 2.3.1 |
| tensorflow-gpu | pip | < 1.15.4 | 1.15.4 |
| tensorflow-gpu | pip | >= 2.0.0, < 2.0.3 | 2.0.3 |
| tensorflow-gpu | pip | >= 2.1.0, < 2.1.2 | 2.1.2 |
| tensorflow-gpu | pip | = 2.2.0 | 2.2.1 |
| tensorflow-gpu | pip | = 2.3.0 | 2.3.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability root cause was identified in the Compute method of StringNGramsOp where data_splits validation was missing. The GitHub patch shows validation logic was added to this exact function in string_ngrams_op.cc, checking split values against input data size. The CVE description explicitly references tf.raw_ops.StringNGrams as the vulnerable entry point, which maps to this implementation. The test case additions in raw_ops_test.py further confirm the vulnerability was in the core StringNGrams operation handling.