critical
CVE-2022-41900
CVE-2022-41900 affecting package tensorflow for versions less than 2.11.0-1
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA7.1CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, Bitnami, CBL-Mariner. Rated lower by GHSA (high).
Description
TensorFlow is an open source platform for machine learning. The security vulnerability results in FractionalMax(AVG)Pool with illegal pooling_ratio. Attackers using Tensorflow can exploit the vulnerability. They can access heap memory which is not in the control of user, leading to a crash or remote code execution. We have patched the issue in GitHub commit 216525144ee7c910296f5b05d214ca1327c9ce48. The fix will be included in TensorFlow 2.11.0. We will also cherry pick this commit on TensorFlow 2.10.1.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | tensorflow | 2.8.4, 2.9.3, 2.10.1 |
| CBL-Mariner 2.0 | tensorflow | 0:2.11.0-1.cm2 |
| pip::GitHub Security Advisory pip | tensorflow, tensorflow-cpu, tensorflow-gpu | 2.8.4, 2.9.3, 2.10.1 |
Show all 5 entries from 3 sources
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | tensorflow | 2.8.4, 2.9.3, 2.10.1 |
| CBL-Mariner 2.0 | tensorflow | 0:2.11.0-1.cm2 |
| pip::GitHub Security Advisory pip | tensorflow | 2.8.4, 2.9.3, 2.10.1 |
| pip::GitHub Security Advisory pip | tensorflow-cpu | 2.8.4, 2.9.3, 2.10.1 |
| pip::GitHub Security Advisory pip | tensorflow-gpu | 2.8.4, 2.9.3, 2.10.1 |