{"data":{"id":"52e99dd0-6eac-4b9e-a175-20a1f3cdbd3c","title":"CVE-2022-23583: Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a…","summary":"CVE-2022-23583 in TensorFlow lets a malicious user cause a denial of service by modifying a SavedModel so that the protobuf part for the tensor arguments no longer matches the dtype expected by a binary op. The mismatch causes type confusion, and in some scenarios it triggers a CHECK crash. The source says most cases fail silently, while some crash.","solution":"The fix will be included in TensorFlow 2.8.0. The commit will also be cherrypicked to TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, which the source says are affected and still in supported range.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-23583","publishedAt":"2022-02-05T04:15:14.820Z","cveId":"CVE-2022-23583","cweIds":["CWE-617","CWE-843"],"cvssScore":"6.5","cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["tensorflow@< 2.5.3 (fixed: 2.5.3)","tensorflow@>= 2.6.0, < 2.6.3 (fixed: 2.6.3)","tensorflow@= 2.7.0 (fixed: 2.7.1)","tensorflow-cpu@< 2.5.3 (fixed: 2.5.3)","tensorflow-cpu@>= 2.6.0, < 2.6.3 (fixed: 2.6.3)","tensorflow-cpu@= 2.7.0 (fixed: 2.7.1)","tensorflow-gpu@< 2.5.3 (fixed: 2.5.3)","tensorflow-gpu@>= 2.6.0, < 2.6.3 (fixed: 2.6.3)","tensorflow-gpu@= 2.7.0 (fixed: 2.7.1)"],"affectedPackageNames":["tensorflow","tensorflow-cpu","tensorflow-gpu"],"affectedPackageRefs":["pypi:tensorflow","pypi:tensorflow-cpu","pypi:tensorflow-gpu"],"affectedVendors":["Google"],"affectedVendorsRaw":["TensorFlow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Tensorflow denial of service through altered SavedModel binary op dtype","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00879,"epssCheckedAt":"2026-11-04T06:10:14.827Z","kevDateAdded":null,"advisoryAliases":["GHSA-gjqc-q9g6-q2j3"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:58:30.796Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2022-02-02T16:55:58.910Z","daysToFix":-3,"fixCheckedAt":"2026-10-29T21:49:07.446Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"tensorflow-cpu","fixedVersion":"2.6.3","matchedVersion":"2.6.3","fixReleasedAt":"2022-02-02T16:57:11.096Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:49:07.293Z"},{"ecosystem":"pypi","name":"tensorflow-cpu","fixedVersion":"2.5.3","matchedVersion":"2.5.3","fixReleasedAt":"2022-02-02T16:56:59.291Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:49:07.293Z"},{"ecosystem":"pypi","name":"tensorflow-gpu","fixedVersion":"2.6.3","matchedVersion":"2.6.3","fixReleasedAt":"2022-02-02T17:00:49.166Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:49:07.293Z"},{"ecosystem":"pypi","name":"tensorflow-cpu","fixedVersion":"2.7.1","matchedVersion":"2.7.1","fixReleasedAt":"2022-02-02T17:00:16.748Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:49:07.293Z"},{"ecosystem":"pypi","name":"tensorflow-gpu","fixedVersion":"2.7.1","matchedVersion":"2.7.1","fixReleasedAt":"2022-02-02T17:04:59.397Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:49:07.293Z"},{"ecosystem":"pypi","name":"tensorflow","fixedVersion":"2.6.3","matchedVersion":"2.6.3","fixReleasedAt":"2022-02-02T16:56:09.440Z","daysToFix":-3,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:49:07.293Z"},{"ecosystem":"pypi","name":"tensorflow","fixedVersion":"2.5.3","matchedVersion":"2.5.3","fixReleasedAt":"2022-02-02T16:55:58.910Z","daysToFix":-3,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:49:07.293Z"},{"ecosystem":"pypi","name":"tensorflow","fixedVersion":"2.7.1","matchedVersion":"2.7.1","fixReleasedAt":"2022-02-02T16:58:42.928Z","daysToFix":-3,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:49:07.293Z"},{"ecosystem":"pypi","name":"tensorflow-gpu","fixedVersion":"2.5.3","matchedVersion":"2.5.3","fixReleasedAt":"2022-02-02T17:00:33.101Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:49:07.293Z"}]}}