cve.bz

CVE-2022-23590

7.5 highEPSS 1.0%

High (7.5) in google tensorflow. EPSS 1.0% chance of exploitation in the next 30 days. Fixed in tensorflow 2.7.1.

Tensorflow is an Open Source Machine Learning Framework. A `GraphDef` from a TensorFlow `SavedModel` can be maliciously altered to cause a TensorFlow process to crash due to encountering a `StatusOr` value that is an error and forcibly extracting the value from it. We have patched the issue in multiple GitHub commits and these will be included in TensorFlow 2.8.0 and TensorFlow 2.7.1, as both are affected.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
1.0% chance of exploitation in the next 30 days; higher than 62% of CVEs (scores of 2026-10-31)
CWE
CWE-754
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-pqrv-8r2f-7278PyPItensorflow<2.7.12.7.1
GHSA-pqrv-8r2f-7278PyPItensorflow-cpu<2.7.12.7.1
GHSA-pqrv-8r2f-7278PyPItensorflow-gpu<2.7.12.7.1
PYSEC-2022-154PyPItensorflow-gpu<2.7.12.7.1
PYSEC-2022-99PyPItensorflow-cpu<2.7.12.7.1
PYSEC-2026-3225PyPItensorflow<2.7.12.7.1

References

Check your stackJSON