cve.bz

CVE-2020-15206

7.5 highEPSS 1.0%

High (7.5). EPSS 1.0% chance of exploitation in the next 30 days. Fixed in tensorflow 1.15.4, 2.0.3, 2.1.2.

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, changing the TensorFlow's `SavedModel` protocol buffer and altering the name of required keys results in segfaults and data corruption while loading the model. This can cause a denial of service in products using `tensorflow-serving` or other inference-as-a-service installments. Fixed were added in commits f760f88b4267d981e13f4b302c437ae800445968 and fcfef195637c6e365577829c4d67681695956e7d (both going into TensorFlow 2.2.0 and 2.3.0 but not yet backported to earlier versions). However, this was not enough, as #41097 reports a different failure mode. The issue is patched in commit adf095206f25471e864a8e63a0f1caef53a0e3a6, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
1.0% chance of exploitation in the next 30 days; higher than 61% of CVEs (scores of 2026-10-31)
CWE
CWE-20
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-w5gh-2wr2-pm6gPyPItensorflow<1.15.41.15.4
GHSA-w5gh-2wr2-pm6gPyPItensorflow>=2.0.0 <2.0.32.0.3
GHSA-w5gh-2wr2-pm6gPyPItensorflow>=2.1.0 <2.1.22.1.2
GHSA-w5gh-2wr2-pm6gPyPItensorflow>=2.2.0 <2.2.12.2.1
GHSA-w5gh-2wr2-pm6gPyPItensorflow>=2.3.0 <2.3.12.3.1
GHSA-w5gh-2wr2-pm6gPyPItensorflow-cpu<1.15.41.15.4
GHSA-w5gh-2wr2-pm6gPyPItensorflow-cpu>=2.0.0 <2.0.32.0.3
GHSA-w5gh-2wr2-pm6gPyPItensorflow-cpu>=2.1.0 <2.1.22.1.2
GHSA-w5gh-2wr2-pm6gPyPItensorflow-cpu>=2.2.0 <2.2.12.2.1
GHSA-w5gh-2wr2-pm6gPyPItensorflow-cpu>=2.3.0 <2.3.12.3.1
GHSA-w5gh-2wr2-pm6gPyPItensorflow-gpu<1.15.41.15.4
GHSA-w5gh-2wr2-pm6gPyPItensorflow-gpu>=2.0.0 <2.0.32.0.3
GHSA-w5gh-2wr2-pm6gPyPItensorflow-gpu>=2.1.0 <2.1.22.1.2
GHSA-w5gh-2wr2-pm6gPyPItensorflow-gpu>=2.2.0 <2.2.12.2.1
GHSA-w5gh-2wr2-pm6gPyPItensorflow-gpu>=2.3.0 <2.3.12.3.1
PYSEC-2020-129PyPItensorflow<1.15.4
>=2.0.0 <2.0.3
>=2.1.0 <2.1.2
>=2.2.0 <2.2.1
>=2.3.0 <2.3.1		1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1
PYSEC-2020-286PyPItensorflow-cpu<1.15.4
>=2.0.0 <2.0.3
>=2.1.0 <2.1.2
>=2.2.0 <2.2.1
>=2.3.0 <2.3.1		1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1
PYSEC-2020-321PyPItensorflow-gpu<1.15.4
>=2.0.0 <2.0.3
>=2.1.0 <2.1.2
>=2.2.0 <2.2.1
>=2.3.0 <2.3.1		1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1

References

Check your stackJSON