{"data":{"id":"11b1df8e-df41-4cc9-927b-312635cb3e49","title":"CVE-2022-41908: TensorFlow is an open source platform for machine learning. An input `token` that is not a UTF-8 bytestring will trigger","summary":"TensorFlow, an open-source machine learning platform, has a vulnerability where passing a `token` input that is not UTF-8 encoded (a character encoding standard) causes the `tf.raw_ops.PyFunc` function to crash with a CHECK fail (a safety check that stops execution when something is wrong). This is a type of improper input validation weakness, meaning the function doesn't properly check whether its input is in the correct format before processing it.","solution":"The issue has been patched in GitHub commit 9f03a9d3bafe902c1e6beb105b2f24172f238645. The fix is included in TensorFlow 2.11, and will also be patched in TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-41908","publishedAt":"2022-11-19T03:15:21.790Z","cveId":"CVE-2022-41908","cweIds":["CWE-20"],"cvssScore":"4.8","cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":["NVIDIA"],"affectedVendorsRaw":["TensorFlow"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00265,"patchAvailable":null,"disclosureDate":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.92,"researchCategory":null,"atlasIds":null}}