{"data":{"id":"fcb1dc39-1431-41a8-8855-c558376c3e45","title":"CVE-2022-23562: Tensorflow is an Open Source Machine Learning Framework. The implementation of `Range` suffers from integer overflows…","summary":"CVE-2022-23562 affects TensorFlow's implementation of `Range`, which suffers from integer overflows (CWE-190). These can trigger undefined behavior or, in some scenarios, extremely large allocations. The source states that the affected releases include TensorFlow 2.7.1, 2.6.3 and 2.5.3 as well as the version the fix is included in.","solution":"The fix will be included in TensorFlow 2.8.0. The commit will also be cherrypicked onto TensorFlow 2.7.1, 2.6.3 and 2.5.3.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-23562","publishedAt":"2022-02-05T04:15:13.843Z","cveId":"CVE-2022-23562","cweIds":["CWE-190"],"cvssScore":"7.6","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["tensorflow@< 2.5.3 (fixed: 2.5.3)","tensorflow@>= 2.6.0, < 2.6.3 (fixed: 2.6.3)","tensorflow@= 2.7.0 (fixed: 2.7.1)","tensorflow-cpu@< 2.5.3 (fixed: 2.5.3)","tensorflow-cpu@>= 2.6.0, < 2.6.3 (fixed: 2.6.3)","tensorflow-cpu@= 2.7.0 (fixed: 2.7.1)","tensorflow-gpu@< 2.5.3 (fixed: 2.5.3)","tensorflow-gpu@>= 2.6.0, < 2.6.3 (fixed: 2.6.3)","tensorflow-gpu@= 2.7.0 (fixed: 2.7.1)"],"affectedPackageNames":["tensorflow","tensorflow-cpu","tensorflow-gpu"],"affectedPackageRefs":["pypi:tensorflow","pypi:tensorflow-cpu","pypi:tensorflow-gpu"],"affectedVendors":["Google"],"affectedVendorsRaw":["TensorFlow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Tensorflow integer overflow in Range implementation","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00583,"epssCheckedAt":"2026-11-04T06:10:14.546Z","kevDateAdded":null,"advisoryAliases":["GHSA-qx3f-p745-w4hr"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:58:41.174Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2022-02-02T16:55:58.910Z","daysToFix":-3,"fixCheckedAt":"2026-10-29T21:49:21.894Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"tensorflow-cpu","fixedVersion":"2.5.3","matchedVersion":"2.5.3","fixReleasedAt":"2022-02-02T16:56:59.291Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:49:21.741Z"},{"ecosystem":"pypi","name":"tensorflow","fixedVersion":"2.5.3","matchedVersion":"2.5.3","fixReleasedAt":"2022-02-02T16:55:58.910Z","daysToFix":-3,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:49:21.741Z"},{"ecosystem":"pypi","name":"tensorflow","fixedVersion":"2.6.3","matchedVersion":"2.6.3","fixReleasedAt":"2022-02-02T16:56:09.440Z","daysToFix":-3,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:49:21.741Z"},{"ecosystem":"pypi","name":"tensorflow-gpu","fixedVersion":"2.6.3","matchedVersion":"2.6.3","fixReleasedAt":"2022-02-02T17:00:49.166Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:49:21.741Z"},{"ecosystem":"pypi","name":"tensorflow-gpu","fixedVersion":"2.5.3","matchedVersion":"2.5.3","fixReleasedAt":"2022-02-02T17:00:33.101Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:49:21.741Z"},{"ecosystem":"pypi","name":"tensorflow-cpu","fixedVersion":"2.6.3","matchedVersion":"2.6.3","fixReleasedAt":"2022-02-02T16:57:11.096Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:49:21.741Z"},{"ecosystem":"pypi","name":"tensorflow","fixedVersion":"2.7.1","matchedVersion":"2.7.1","fixReleasedAt":"2022-02-02T16:58:42.928Z","daysToFix":-3,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:49:21.741Z"},{"ecosystem":"pypi","name":"tensorflow-cpu","fixedVersion":"2.7.1","matchedVersion":"2.7.1","fixReleasedAt":"2022-02-02T17:00:16.748Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:49:21.741Z"},{"ecosystem":"pypi","name":"tensorflow-gpu","fixedVersion":"2.7.1","matchedVersion":"2.7.1","fixReleasedAt":"2022-02-02T17:04:59.397Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:49:21.741Z"}]}}